Lucene search

TwcertCVELIST:CVE-2022-38117

HistoryOct 24, 2022 - 1:21 p.m.

CVE-2022-38117 Juiker app - Hard-coded Credentials

2022-10-2413:21:03

CWE-798

twcert

www.cve.org

juiker app

hard-coded credentials

aes key

decryption

tampering

android root privilege

physical attacker

CVSS3

5.5

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.

CNA Affected

[
  {
    "vendor": "Juiker",
    "product": "Juiker app",
    "versions": [
      {
        "version": "4.6.0311.1",
        "status": "affected"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html

CVSS3

5.5

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Related for CVELIST:CVE-2022-38117