Executive brief
Blink1Control2, a desktop application for controlling Blink(1) USB LED devices, stores passwords for email event rules using weak encryption. An attacker with access to the application's configuration files could recover plaintext passwords for connected email accounts (IMAP, Gmail), potentially leading to unauthorized access to those accounts.
Technical details
Blink1Control2 versions up to 2.2.7 use outdated cryptographic methods to encrypt passwords stored for email event rules (IMAP, Gmail integration). The vulnerability is classified as inadequate encryption strength (CWE-326). An attacker who gains access to the application's configuration files or database can leverage the weak encryption to derive plaintext passwords. This is particularly concerning because the application stores credentials needed to authenticate with third-party email services. Version 2.2.9 and later address this issue by upgrading to Node.js's native crypto implementation.
Affected products
- Tod Kurt Blink1Control2 <=2.2.7
Timeline
- 2022-09-08: disclosed
- 2022-09-16: patched: Fixed in version 2.2.9