title:  Insecure Data Storage leading to sensitive Information disclosure.
description: Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
defaultStatus: unaffected
platforms: [Android, iOS]
product: eWeLink APP
vendor: CoolKIt
versions:
lessThan: 5.4.x, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to the latest version of the app.