During initial setup, the weather station will submit its complete configuration unencrypted to the manufacturer cloud service. This configuration includes confidential information like the user's Wifi password.
26c45dc9330c4b9106868739be6a04123e25c4881dd15ee9236e856c7b66fbf4
Summary
During initial setup, the weather station will submit its complete configuration unencrypted to the manufacturer cloud service. This configuration includes confidential information like the user's Wifi password.
The problem has been fixed by removing this configuration dump from current firmware versions.
CVE: CVE-2015-1600.
Affected Systems: Netatmo Indoor Module firmware 100 and earlier.
Additional Details: https://isc.sans.edu/forums/diary/Did+You+Remove+That+Debug+Code+Netatmo+Weather+Station+Sending+WPA+Passphrase+in+the+Clear/19327/
Manufacturers web site: www.netatmo.com
Patch: Affected systems will download updated firmware automatically from Netatmo's cloud service.