PT-2025-10132 · Tangem · Tangem Sdk

Published 2025-03-07 · Updated 2025-03-08 · CVE-2025-27839

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tangem SDK versions prior to 5.18.3

Description The issue is related to a logic flow in offline wallet attestation, specifically in the genuineness check, which causes verification results to be disregarded during the first scan of a card. This is located in the operations/attestation/AttestationTask.kt file. It is unclear if exploitation of this issue was possible.

Recommendations For versions prior to 5.18.3, update to version 5.18.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-1025

Related Identifiers

CVE-2025-27839

Affected Products

Tangem Sdk

References · 10

• https://osv.dev/vulnerability/CVE-2025-27839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27839 · Security Note
• https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409 · Note
• https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07 · Note
• https://twitter.com/CVEnew/status/1898246416192901279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898186373028327570 · Twitter Post
• https://t.me/cvedetector/19870 · Telegram Post
• https://tangem.com/en/blog/post/app-update · Note
• https://t.me/cvenotify/113965 · Telegram Post
• https://t.me/cvetracker/18718 · Telegram Post