CVE-2023-5879: Aladdin Connect Android Application Insecure Storage

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-03 · updated 2026-06-17
Weakness: CWE-922

Description

Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.

Affected products

The Genie Company Aladdin Connect Mobile Application: before 5.73 — fixed in 5.73

How to fix

Upgrade to a fixed version: The Genie Company Aladdin Connect Mobile Application 5.73. Check the vendor advisory for mitigations.

References

https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/
https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/

Get alerted when CVE-2023-5879 or the next vulnerability affects your stack