What’s Vulnerable › Vulnerabilities

CVE-2019-5627: BlueCats Reveal iOS App Insecure Storage

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-22 · updated 2026-06-17
• Weakness: CWE-922

Description

The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the iOS device or compromise it with a malicious app.

Affected products

• BlueCats Bc Reveal: before 5.14 — fixed in 5.14

How to fix

Upgrade to a fixed version: BlueCats Bc Reveal 5.14. Check the vendor advisory for mitigations.

References

• https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/
• https://itunes.apple.com/us/app/bc-reveal/id852676494
• https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/
• https://itunes.apple.com/us/app/bc-reveal/id852676494

Get alerted when CVE-2019-5627 or the next vulnerability affects your stack