CVE-2024-3130

Hard-coded Credentialsin CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker tounauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.7 MEDIUM
LOCAL
HIGH
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CoolKitCNA
5.7 MEDIUM
LOCAL
HIGH
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
5.7 MEDIUM
LOCAL
HIGH
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Common Weakness Enumeration
References
https://ewelink.cc/security-advisories-and-notices/
https://ewelink.cc/security-advisories-and-notices/