JVN#94004488
Smartphone application "Vehicle Inspection Certificate Viewer" vulnerable to sensitive information disclosure

Overview

The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism contains a vulnerability in which sensitive information may be included in data transmitted by the application.

Products Affected

• Vehicle Inspection Certificate Viewer (for Android) ver.6.2.0 and earlier
• Vehicle Inspection Certificate Viewer (for iOS) ver.6.2.0 and earlier

Description

The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism includes an API integration feature for operators handling vehicle inspection certificates.
The specifications for the API integration contain the following vulnerability:

• Insertion of Sensitive Information Into Sent Data (CWE-201)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 6.9
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 5.3
  • CVE-2026-75559

Impact

API integration credentials, including an access ID and access key, may be disclosed.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

Note that the developer has issued new access IDs and access keys to API users and has revoked the access IDs and access keys that may have been exposed.
Therefore, this vulnerability can no longer be exploited.