Smart-tab Android App Debug Code and Plaintext Password Storage Vulnerabilities (CVE-2024-41999/CVE-2024-42496)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: JVN#42445661 2. Vulnerability Name: Multiple vulnerabilities in Smart-tab 3. Affected Products: - Smart-tab Android app, installed on or before April 2023. 4. Description: - Smart-tab is a multi-functional guest room tablet system provided by TECHNO SUPPORT COMPANY, used in hotels and other accommodation facilities. - Smart-tab contains the following multiple vulnerabilities: - Active debug code (CWE-489) - Plaintext storage of a password (CWE-256) 5. Impact: - Attackers with physical access can exploit the debug functionality to access operating system features, escalate privileges, modify device settings, or spoof devices in other rooms. - Attackers with physical access can obtain credential information and spoof device access to related external services. 6. Solution: - Update the product to the fixed version. - According to the developer’s notification, they have reported these vulnerabilities to users and updated the affected products. 7. References: - JPCERT/CC Addendum - Vulnerability Analysis by JPCERT/CC 8. Credits: - These vulnerabilities were reported to IPA by Shuto Imai of LAC Co., Ltd. - JPCERT/CC collaborated with the developers through the Information Security Early Warning Partnership. 9. Additional Information: - JPCERT Alert - JPCERT Reports - CERT Advisory - CPNI Advisory - TRnotes - CVE IDs: CVE-2024-41999, CVE-2024-42496 - JVN iPedia: JVNDB-2024-000105 This information provides a detailed description of the Smart-tab vulnerabilities, their impact, solutions, and relevant reference links.

Goal Reached Thanks to every supporter — we hit 100%!

Smart-tab Android App Debug Code and Plaintext Password Storage Vulnerabilities (CVE-2024-41999/CVE-2024-42496)