title: Juiker app - Hard-coded Credentials
description: Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
vendor: Juiker
product: Juiker app
versions:
version: 4.6.0311.1, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
]
solutions: Update Juiker app version to 4.6.0915.1