JVN#42445661
Multiple vulnerabilities in Smart-tab

Overview

Smart-tab provided by TECHNO SUPPORT COMPANY contains multiple vulnerabilities.

Products Affected

• Smart-tab Android app installed April 2023 or earlier

Description

Smart-tab provided by TECHNO SUPPORT COMPANY is a multi-functional guest room tablet system for hotels and other accommodation facilities. Smart-tab contains multiple vulnerabilities listed below.

• Active debug code (CWE-489)
  • CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 6.8
  • CVE-2024-41999
• Plaintext storage of a password (CWE-256)
  • CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 2.4
  • CVE-2024-42496

Impact

• An attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's settings, or spoof devices in other rooms (CVE-2024-41999)
• An attacker with physical access to the device may retrieve the credential information, and spoof the device to access the related external service (CVE-2024-42496)

Solution

Update the product
Update the product to the fixed version.

According to the developer, they have notified these vulnerabilities to the users and have updated the affected products.