Which versions of Smartlog App are affected by CVE-2026-4216?

Organizations using i-SENS SmartLog App should be aware of moderate risk from CVE-2026-4216, a hard-coded credentials vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4216?

Yes, a public proof-of-concept exploit is available for CVE-2026-4216. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4216?

Within 30 days: Identify affected systems running i-SENS SmartLog App and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Smartlog App CVE-2026-4216

Q: What is the CVSS score of CVE-2026-4216?

CVE-2026-4216 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12335 LOW

Use of Hard-coded Credentials (CWE-798)

2026-03-16 VulDB

Authentication Bypass Google Smartlog App

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

5.3 (MEDIUM) 4.8 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 06:00 euvd

EUVD-2026-12335

Analysis Generated

Mar 16, 2026 - 06:00 vuln.today

CVE Published

Mar 16, 2026 - 05:02 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: "The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it."

AnalysisAI

Hard-coded credentials exist in the i-SENS SmartLog Android application (versions up to 2.6.8) within a developer mode function used for Bluetooth pairing configuration between blood glucose meters and the mobile app. An attacker with local access and low privileges can exploit this to obtain credentials, potentially compromising the integrity and confidentiality of health data. A public proof-of-concept is available, though the CVSS 5.3 score and local-only attack vector limit immediate widespread exploitation risk.

Technical ContextAI

The vulnerability (CWE-798: Use of Hard-Coded Credentials) resides in the air.SmartLog.android component of the i-SENS SmartLog Android application. The affected product is identified via CPE as i-SENS SmartLog on Android platform through version 2.6.8. The root cause is the embedding of authentication credentials directly into the application code within a developer mode function that handles Bluetooth device pairing and configuration for glucose monitoring devices. This function was intentionally left in production builds for testing and integration purposes but was never properly secured or removed before deployment. The vendor has acknowledged the issue and committed to removing or restricting access to the developer mode in future updates, indicating this was a known design choice rather than an accidental oversight.

RemediationAI

Users should upgrade i-SENS SmartLog to the latest available version once released by i-SENS, which will include removal or restriction of the developer mode containing hard-coded credentials. Until an official patch is available, users should restrict physical device access to trusted individuals and avoid installing the application on shared or unsecured devices. Organizations deploying SmartLog in clinical or multi-user environments should implement device management policies limiting installation to controlled devices and should monitor for suspicious authentication or pairing activity. Consult the i-SENS vendor security advisory for exact patch release dates and version recommendations.