Lucene search

CoolKitCVELIST:CVE-2024-3130

HistoryApr 01, 2024 - 9:13 a.m.

CVE-2024-3130 Insecure Data Storage leading to sensitive Information disclosure.

2024-04-0109:13:53

CWE-798

CoolKit

www.cve.org

cve-2024-3130; hard-coded credentials; coolkit ewelink app; android; ios; local attacker; decryption algorithm; decompiling app; sensitive data

5.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Android",
      "iOS"
    ],
    "product": "eWeLink APP",
    "vendor": "CoolKIt",
    "versions": [
      {
        "lessThan": "5.4.x",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

ewelink.cc/security-advisories-and-notices/

5.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-3130