PT-2026-25760 · Unknown · La Nacion App

Fxizenta + 1 · Publicado 2026-03-16 · Atualizado 2026-03-23 · CVE-2026-4243

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions La Nacion App version 10.2.25

Description A weakness exists in La Nacion App version 10.2.25 on Android. The issue impacts an unknown function within the file source/app/lanacion/clublanacion/BuildConfig.java of the app.lanacion.activity component. Manipulation of the API KEY WEBSOCKET CV argument can result in the unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, despite the public availability of the exploit. The vendor was notified but did not respond.

Recommendations Update to a newer version of La Nacion App that addresses this issue. As a temporary workaround, restrict or disable the use of the API KEY WEBSOCKET CV argument until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

CWE-256

Identificadores relacionados

BIT-NGINX-INGRESS-CONTROLLER-2026-4342

CVE-2026-4243

Produtos afetados

La Nacion App

Referências · 11

• 🔥 https://notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link · Exploit
• https://github.com/kubernetes/kubernetes/issues/137893 · Nota
• https://vuldb.com/?id.351185 · Nota
• https://vuldb.com/?ctiid.351185 · Nota
• https://vuldb.com/?submit.771432 · Nota
• https://twitter.com/CVEnew/status/2033583620204728516 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2026-4342 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4342 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2033590314007457937 · Publicação no Twitter
• https://cve.org/cverecord?id=CVE-2026-4342 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-4243 · Nota de Segurança