Skip to content
CVE PROGRAM SOURCE RECORD3.9 Low

CVE-2021-25266

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Sophos

Description

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sophos Intercept X for Mobile (Android)

  • unspecified to < 9.7.3495affected

Sophos Sophos Authenticator (Android)

  • unspecified to ≤ 3.4affected

References