EUVD-2026-67100
GHSA-2pvm-92qx-mc83
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Android deep-link exploitation requires the victim to open a crafted link (UI:R); code exec is app-sandboxed (S:U) with high confidentiality/integrity impact but limited availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
AnalysisAI
Information disclosure and in-app arbitrary code execution affect the EcoOnline EHS Android application (package com.airsweb.v10) version 0.2.499, where an improperly protected/exported AndroidManifest.xml component (a public PoC names it a DeepLink issue) lets a remote attacker access sensitive data and run code within the app's context. The MITRE-assigned record carries a CVSS of 9.8 and CWE-200, but EPSS is low (0.31%, 23rd percentile) and there is no CISA KEV listing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the EcoOnline EHS Android app (com.airsweb.v10) v0.2.499 installed on the target device, and invocation of the vulnerable exported AndroidManifest.xml component - per the PoC, via a crafted deep link. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is almost certainly overstated for a mobile deep-link/exported-component flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified at time of analysis; the description names 0.2.499 as vulnerable but no fixed build is cited in the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of EcoOnline EHS Android version 0.2.499 deployments across your organization, identify which business units and user groups depend on the application for compliance operations, and audit what sensitive data (health records, incident reports, safety assessments) is processed through the app. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allShare
External POC / Exploit Code
Leaving vuln.today