What’s Vulnerable › Vulnerabilities

CVE-2024-3130: Insecure Data Storage leading to sensitive Information disclosure.

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-01 · updated 2026-06-17
• Weakness: CWE-798

Description

Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app

Affected products

• CoolKIt eWeLink APP: before 5.4.x — fixed in 5.4.x

How to fix

Upgrade to a fixed version: CoolKIt eWeLink APP 5.4.x. Check the vendor advisory for mitigations.

References

• https://ewelink.cc/security-advisories-and-notices/
• https://ewelink.cc/security-advisories-and-notices/

Get alerted when CVE-2024-3130 or the next vulnerability affects your stack