What is the CVSS score of CVE-2024-3130?

CVE-2024-3130 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Apple CVE-2024-3130

MEDIUM

Use of Hard-coded Credentials (CWE-798)

2024-04-01 68870bb1-d075-4169-957d-e580b18692b9

Authentication Bypass Apple Information Disclosure Google

5.7

CVSS 3.1 · Vendor: 68870bb1-d075-4169-957d-e580b18692b9

Severity by source

Vendor (68870bb1-d075-4169-957d-e580b18692b9) PRIMARY

5.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (68870bb1-d075-4169-957d-e580b18692b9) · only source for this CVE.

CVSS VectorVendor: 68870bb1-d075-4169-957d-e580b18692b9

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Apr 01, 2024 - 10:15 cve.org

MEDIUM 5.7

DescriptionCVE.org

Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app

AnalysisAI

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app Version information: before 5.4..

Affected ProductsAI

CoolKit eWeLlink app are.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.