Yorisou e Net EUVD-2026-86531

Exploitation requires access to the installed 'Yorisou e Net' Android or iOS application (per CVSS AV:P, physical access to the device) so the attacker can inspect or reverse-engineer the app package to recover the embedded key. There is no authentication or user-interaction requirement beyond obtaining the app, but impact is limited to disclosure of the hard-coded key itself (C:L, no integrity/availability impact); the physical-access gating and lack of automatability substantially limit real-world risk. Any downstream damage depends on what data the recovered key protects, which the advisory does not specify.

All signals point to a low-priority issue. The vendor/JPCERT CVSS 3.0 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 2.4) requires physical access to the device/app and yields only low confidentiality impact (recovery of an embedded key), with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis.' The realistic risk is that extracting a hard-coded cryptographic key could weaken protection of data the app encrypts, but exploitation is not automatable and is gated by device access. Note a discrepancy: the vector uses AV:P (physical), yet hard-coded-key extraction is typically achievable via local reverse-engineering of the installed app binary (AV:L) - the vendor scoping should be verified. Overall this is a genuinely low-severity, low-urgency finding rather than a high-CVSS-but-overstated case.

An attacker with access to a device running the 'Yorisou e Net' Android or iOS app reverse-engineers the application package to extract the hard-coded cryptographic key embedded in the binary. With that key, the attacker could decrypt or forge data the app protects with it. No public exploit code is available and the CVSS vector indicates physical access with low confidentiality impact only.