CVE-2023-46919 Hardcoded credentials in n/a
Attackers with physical access can extract a hardcoded AES key to decrypt TLS secrets in the Simple HTTP Server Android app.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46919?
CVE-2023-46919 is a medium-severity vulnerability in n/a, published on 27 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret.
Weakness: CWE-798
Which versions are affected by CVE-2023-46919?
It affects 2 products.
Products include Fedirtsapana Simple Http Server, Fedirtsapana Simple Http Server Plus.
How do I fix CVE-2023-46919?
No fix has been published for CVE-2023-46919 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-46919 being exploited?
There is no known exploitation of CVE-2023-46919 in the wild and no public exploit code.
Sources
Also known as GHSA-988h-g4r8-m9x7.