Skip to content
OpenAdvisories
Low · 3.9 CVE-2021-25266 EUVD-2021-12177GHSA-hgq7-cw57-j447

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in…

Published Apr 27, 2022 · Updated Aug 3, 2024 · Assigned by Sophos

Vendor: Sophos Product: Intercept X for Mobile (Android) Product: Sophos Authenticator (Android) Platform: Android Category: Network devices

Description

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.

Affected products

VendorProductAffectedFixed
Sophos Intercept X for Mobile (Android) unspecified – < 9.7.3495 9.7.3495
Sophos Sophos Authenticator (Android) unspecified – ≤ 3.4 —

References