PT-2026-25615 · Undefined · Undefined

Fxizenta + 1 · Publicado 2026-03-16 · Atualizado 2026-03-16 · CVE-2026-4218

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions myAEDES App versions through 1.18.4

Description A flaw exists in myAEDES App on Android that allows information disclosure. The issue is related to the manipulation of the AUTH KEY argument within an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the aedes.me.beta component. This issue is only exploitable with local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions through 1.18.4 should be updated when a fix is available. As a temporary workaround, consider restricting access to the aedes.me.beta component to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Improper Access Control

Enumeração de Fraquezas

CWE-200

CWE-284

Identificadores relacionados

CVE-2026-4218

Produtos afetados

Undefined

Referências · 8

• 🔥 https://notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_link · Exploit
• https://vuldb.com/?submit.770509 · Nota
• https://twitter.com/infoflowcloud/status/2033585772192833821 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033583707471458547 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4218 · Nota de Segurança
• https://t.me/CVEtracker/47507 · Publicação no Telegram
• https://vuldb.com/?ctiid.351142 · Nota
• https://vuldb.com/?id.351142 · Nota