Hardcoded Cryptographic Key in My Invisalign Android App

Impact Analysis

The vulnerability allows an attacker with local access to the device to exploit the use of a hard-coded cryptographic key. This can potentially compromise the confidentiality of sensitive data protected by this key, as the attacker may be able to decrypt or manipulate data that relies on this cryptographic key.

However, the CVSS scores indicate a low severity impact, with a base score of 1.7 (v2.0) and 3.3 (v3.1), suggesting limited impact on integrity and availability, and no impact on authentication.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Align Technology My Invisalign App version 3.12.4 on Android. It involves an unknown function within the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The issue arises from the manipulation of the argument CDAACCESS_TOKEN, which leads to the use of a hard-coded cryptographic key. This means that the cryptographic key is fixed and embedded in the code, which can be exploited by an attacker.

The attack must be performed locally on the device, and the exploit is publicly available, increasing the risk of exploitation. The vendor was informed early about this vulnerability but did not respond.

Useful 0 Not Useful 0