JVN#93985674
Smartphone application Tohoku Electric Power "Yorisou e Net" vulnerable to use of hard-coded cryptographic key

Overview

Smartphone application Tohoku Electric Power "Yorisou e Net" provided by Tohoku Electric Power Company, Incorporated uses a hard-coded cryptographic key.

Products Affected

• Tohoku Electric Power "Yorisou e Net" Android App versions prior to 2.8.0
• Tohoku Electric Power "Yorisou e Net" iOS App versions prior to 2.8.0

Description

Smartphone application Tohoku Electric Power "Yorisou e Net" provided by Tohoku Electric Power Company, Incorporated contains the following vulnerability:

• Use of hard-coded cryptographic key (CWE-321)
  • CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 2.4
  • CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 2.4
  • CVE-2026-75553

Impact

An attacker could retrieve a hard-coded cryptographic key from the affected product.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.