Vulnerability Spotlight: Multiple bugs in Open Weave and Nest Labs Nest Cam IQ indoor camera

Summary: Cisco Talos discovered multiple vulnerabilities in the Nest Cam IQ Indoor camera, version 4620002, most of them in the weave binary, with some also applying to the weave-tool binary. The flaws include denial-of-service bugs triggered by TCP connections and crafted Weave packets, an out-of-bounds read in legacy pairing, a PASE pairing brute force that can yield full device control, and code execution in Openweave-core 4.0.2's print-tlv and ASN1Writer functions.
Why it matters: The PASE pairing brute force (CVE-2019-5035) can take an attacker from crafted packets to greater Weave access and potentially full control of a camera that includes facial recognition and Google Assistant, and Talos published Snort rules 49843-49855, 49797, 49798, 49801-49804, 49856, 49857, 49813-49816 and 49912 for detection.

Read the original at Cisco Talos ↗

Topics: Endpoint & Network Security
Mentions: CVE-2019-5034 CVE-2019-5035 CVE-2019-5036 CVE-2019-5037 CVE-2019-5038
Related: Vulnerability Spotlight: Multiple vulnerabilities in Aspose APIs Cyber Risks ·
Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026
Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026