Vehicle Inspection Certificate Viewer For Android
Monthly
Information disclosure in the Vehicle Inspection Certificate Viewer mobile application for Android and iOS causes the app to include API integration credentials - an access ID and an access key - inside the data it transmits, so anyone who can observe or intercept that client-server traffic can recover the credentials. Both platform editions are listed as affected with no version constraint (CPE wildcards for the Android and iOS builds), and the vendor advisory (JVN#94004488, reported to JPCERT) does not identify a fixed release. Exploitation is not trivial: it requires an attacker to obtain a network vantage point such as a man-in-the-middle position on the app's communication path, and there is no public exploit identified at time of analysis; with CVSS 5.3 (C:L/I:N/A:N) the practical impact depends on what the leaked credentials authorize.
Information disclosure in the Vehicle Inspection Certificate Viewer mobile application for Android and iOS causes the app to include API integration credentials - an access ID and an access key - inside the data it transmits, so anyone who can observe or intercept that client-server traffic can recover the credentials. Both platform editions are listed as affected with no version constraint (CPE wildcards for the Android and iOS builds), and the vendor advisory (JVN#94004488, reported to JPCERT) does not identify a fixed release. Exploitation is not trivial: it requires an attacker to obtain a network vantage point such as a man-in-the-middle position on the app's communication path, and there is no public exploit identified at time of analysis; with CVSS 5.3 (C:L/I:N/A:N) the practical impact depends on what the leaked credentials authorize.