What is the CVSS score of CVE-2025-1029?

CVE-2025-1029 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of SoliClub are affected by CVE-2025-1029?

Utarit Information Services SoliClub Android app (versions 5.2.4-5.3.7) contains hard-coded credentials that expose sensitive constants to any remote attacker without authentication, creating a…

How to fix or mitigate CVE-2025-1029?

24 hours: Inventory all instances of SoliClub app versions 5.2.4-5.3.7 in use (internal and user-facing); document what sensitive constants are exposed. 7 days: Notify all affected users to uninstall or cease using the app until patched; rotate any API keys, tokens, or credentials that match the hard-coded values; review logs for unauthorized access patterns using those credentials. 30 days: Monitor Utarit's official channels and security advisories for patch release; plan immediate deployment of patched version (>5.3.7) once available; conduct security audit of downstream systems accessed via exposed credentials.

SoliClub CVE-2025-1029

HIGH

Use of Hard-coded Credentials (CWE-798)

2025-12-18 iletisim@usom.gov.tr

Authentication Bypass Soliclub

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 08:31 vuln.today

CVE Published

Dec 18, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable.

This issue affects SoliClub: from 5.2.4 before 5.3.7.

AnalysisAI

Hard-coded credentials in Utarit Information Services SoliClub Android app (versions 5.2.4 through 5.3.7) allow remote unauthenticated attackers to read sensitive constants embedded within the executable. The flaw was reported by Turkey's national CERT (USOM) and carries a CVSS 7.5 with high confidentiality impact but no integrity or availability effect; no public exploit identified at time of analysis and EPSS is very low at 0.04%.

Technical ContextAI

SoliClub is a mobile loyalty/membership Android application published by Utarit Information Services, as confirmed by the CPE string cpe:2.3:a:utarit:soliclub targeting the android platform. The root cause maps to CWE-798 (Use of Hard-coded Credentials), meaning secrets such as API keys, tokens, or backend credentials are compiled directly into the APK binary. Because Android applications are distributed as easily decompilable packages, any constant embedded in DEX/native code can be extracted with standard reverse-engineering tooling (apktool, jadx, strings), exposing the secret to anyone who downloads the app from the Play Store or an APK mirror.

RemediationAI

Vendor-released patch: SoliClub 5.3.7 - upgrade the Android application to 5.3.7 or later via Google Play, as described in the USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0466. Because the hard-coded secret has been exposed in distributed binaries, the vendor should additionally rotate and revoke any embedded credentials, API keys, or tokens on the backend so previously extracted values cannot be reused even against unpatched clients; consumers cannot remediate this server-side dependency themselves. As a compensating control until upgrade, organizations distributing the app to managed devices can block the affected version range via MDM and force-update to 5.3.7, accepting the trade-off that users on older Android versions incompatible with 5.3.7 will lose app functionality.