PT-2026-25760 · Unknown · La Nacion App

Fxizenta + 1 · Published 2026-03-16 · Updated 2026-03-23 · CVE-2026-4243

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions La Nacion App version 10.2.25

Description A weakness exists in La Nacion App version 10.2.25 on Android. The issue impacts an unknown function within the file source/app/lanacion/clublanacion/BuildConfig.java of the app.lanacion.activity component. Manipulation of the API KEY WEBSOCKET CV argument can result in the unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, despite the public availability of the exploit. The vendor was notified but did not respond.

Recommendations Update to a newer version of La Nacion App that addresses this issue. As a temporary workaround, restrict or disable the use of the API KEY WEBSOCKET CV argument until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-255

CWE-256

Related Identifiers

BIT-NGINX-INGRESS-CONTROLLER-2026-4342

CVE-2026-4243

Affected Products

La Nacion App

References · 11

• 🔥 https://notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link · Exploit
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2026-4342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4342 · Security Note
• https://cve.org/cverecord?id=CVE-2026-4342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4243 · Security Note
• https://github.com/kubernetes/kubernetes/issues/137893 · Note
• https://vuldb.com/?id.351185 · Note
• https://vuldb.com/?ctiid.351185 · Note
• https://vuldb.com/?submit.771432 · Note
• https://twitter.com/CVEnew/status/2033583620204728516 · Twitter Post
• https://twitter.com/cyberbivash/status/2033590314007457937 · Twitter Post