CVE-2019-25605
Insecure Logging in EquityPandit 1.0 Exposes User Credentials
Publication date: 2026-03-22
Last updated on: 2026-03-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| equitypandit | equitypandit | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-612 | The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge (adb).'}, {'type': 'paragraph', 'content': 'Specifically, during the "forgot password" function, the application logs plaintext passwords to the Android developer console (logcat). An attacker with local access can use adb commands to extract these passwords from the device logs.'}, {'type': 'paragraph', 'content': 'This vulnerability arises because the application improperly logs sensitive data, enabling attackers to retrieve user passwords without requiring privileges or user interaction.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive user credentials, specifically plaintext passwords.
An attacker with local access to the device can exploit this flaw to extract user account passwords from the logs, potentially leading to account compromise.
Because the attack requires only adb access and no special privileges or user interaction, it increases the risk of credential theft on affected devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by examining the Android device logs for sensitive information such as plaintext passwords being logged during the forgot password function.'}, {'type': 'paragraph', 'content': 'A specific command to detect this vulnerability is using the Android Debug Bridge (adb) to dump the device logs and search for password entries.'}, {'type': 'list_item', 'content': 'Run the command `adb logcat -d` to dump the device logs.'}, {'type': 'list_item', 'content': 'Use a script or manual search to find occurrences of the pattern "password <value>" in the logs.'}, {'type': 'paragraph', 'content': 'For example, a Python script named capture.py can automate this by connecting to the device via adb, dumping the logs, and extracting all logged passwords.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
I don't know