CVE-2026-4216
Hardcoded Credentials in i-SENS SmartLog Android App (Local
Publication date: 2026-03-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| i-sens | smartlog_app | to 2.6.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-259 | The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the i-SENS SmartLog App up to version 2.6.8 on Android. It involves a weakness in a developer mode function used during the Bluetooth pairing configuration between the blood glucose meter and the SmartLog application. This function contains hard-coded credentials that can be manipulated. The attack exploiting this vulnerability can only be performed locally.
The developer mode function is intended for configuration and testing purposes but is currently accessible in the deployed system. The vendor plans to either remove this function or restrict access to it in a future update.
How can this vulnerability impact me? :
The vulnerability allows an attacker with local access to exploit hard-coded credentials within the developer mode function of the SmartLog app. This could potentially lead to unauthorized access or manipulation of the Bluetooth pairing process between the blood glucose meter and the app.
Since the attack requires local access, remote exploitation is not possible. However, if an attacker gains physical or local access to the device, they could misuse the developer mode to compromise the device integration or testing functions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a developer mode function used during Bluetooth pairing configuration that contains hard-coded credentials and can only be exploited locally.
Immediate mitigation steps include restricting access to the developer mode function or disabling it if possible.
Monitor for updates from the vendor, as they plan to review measures to remove or restrict access to this function in a future application update.