JVN#74534998: Android App "IIJ SmartKey" vulnerable to information disclosure

Android App “IIJ SmartKey” provided by Internet Initiative Japan Inc. contains an information disclosure vulnerability (CWE-200).

Impact

Under certain conditions, an attacker may obtain a one-time password issued by the product.

Solution

Update the application
Update the application to the latest version according to the information provided by the developer.
This vulneravility was fixed in version 2.1.4 released on June 16, 2020.

Products Affected

• Android App “IIJ SmartKey” versions prior to 2.1.4