Tohoku Electric Power Yorisou E Net Android App
Monthly
Hard-coded cryptographic key material embedded in the Tohoku Electric Power 'Yorisou e Net' Android and iOS apps can be recovered by inspecting or reverse-engineering the installed application package, potentially exposing whatever data or service that key protects. Both mobile builds are affected (per the vendor CPE entries), and the CVSS vector indicates physical access to the device (AV:P) with no authentication (PR:N) and no user interaction (UI:N) required, so the practical gate is simply obtaining and analyzing the app rather than any remote precondition. Impact is confined to a low-confidence confidentiality loss (C:L, no integrity or availability effect) and the advisory does not specify what the recovered key protects downstream; all signals point to a low-priority issue, with no public exploit code identified at time of analysis and no EPSS or KEV data provided. The JVN advisory JVN93985674 is the primary coordinated-disclosure reference.
Hard-coded cryptographic key material embedded in the Tohoku Electric Power 'Yorisou e Net' Android and iOS apps can be recovered by inspecting or reverse-engineering the installed application package, potentially exposing whatever data or service that key protects. Both mobile builds are affected (per the vendor CPE entries), and the CVSS vector indicates physical access to the device (AV:P) with no authentication (PR:N) and no user interaction (UI:N) required, so the practical gate is simply obtaining and analyzing the app rather than any remote precondition. Impact is confined to a low-confidence confidentiality loss (C:L, no integrity or availability effect) and the advisory does not specify what the recovered key protects downstream; all signals point to a low-priority issue, with no public exploit code identified at time of analysis and no EPSS or KEV data provided. The JVN advisory JVN93985674 is the primary coordinated-disclosure reference.