Hard-coded AES Key in Juiker App Allows Unauthorized Decryption and Tampering

CVE-2022-38117 · MEDIUM Severity

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.

Learn more about our Cis Benchmark Audit For Google Android.