Vulnerability · Published Mar 29, 2021 · Assigned by mitre
CVE-2020-35138
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.2%top 32.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack
Affected products (as reported)
References
- https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US x_refsource_MISC
- https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration x_refsource_MISC
- https://github.com/optiv/rustyIron x_refsource_MISC
- https://www.ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-research x_refsource_MISC
- https://www.optiv.com/insights/source-zero/blog/mobileiron-mdm-contains-static-key-allowing-account-enumeration x_refsource_MISC