What’s Vulnerable › Vulnerabilities

CVE-2019-5626: BlueCats Reveal Android App Insecure Storage

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-22 · updated 2026-06-17
• Weakness: CWE-922

Description

The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app.

Affected products

• Bluecats Reveal: before 3.0.19 — fixed in 3.0.19

How to fix

Upgrade to a fixed version: Bluecats Reveal 3.0.19. Check the vendor advisory for mitigations.

References

• https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/
• https://play.google.com/store/apps/details?id=com.bluecats.bcreveal
• https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/
• https://play.google.com/store/apps/details?id=com.bluecats.bcreveal

Get alerted when CVE-2019-5626 or the next vulnerability affects your stack