1. Home
  2. CVE Database
  3. CVE-2021-25266
LOW · 3.9

CVE-2021-25266

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and ...

Vulnerability Description

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.

CVSS Score

3.9

LOW

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
SophosAuthenticator<= 3.4
SophosIntercept X< 9.7.3495

Related Weaknesses (CWE)

CWE-922

References

FAQ

What is CVE-2021-25266?

CVE-2021-25266 is a vulnerability with a CVSS score of 3.9 (LOW). An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and ...

How severe is CVE-2021-25266?

CVE-2021-25266 has been rated LOW with a CVSS base score of 3.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-25266?

Check the references section above for vendor advisories and patch information. Affected products include: Sophos Authenticator, Sophos Intercept X.