CVE-2026-75553
Received Received - Intake

Hard-Coded Cryptographic Key in Yorisou e Net App

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: JPCERT/CC

Description
Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-75553
EUVD
EUVD-2026-86531

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tohoku_electric_power_company yorisou_e_net to 2.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-75553 involves the smartphone application 'Yorisou e Net' by Tohoku Electric Power Company using a hard-coded cryptographic key. This means the key is embedded directly in the app's code, which could allow an attacker to retrieve it and potentially compromise encrypted communications or data.

Impact Analysis

If exploited, an attacker could retrieve the hard-coded key and use it to decrypt sensitive data transmitted or stored by the app. This may lead to unauthorized access to user information, such as personal details or financial data, depending on the app's functions.

Mitigation Strategies

Update the smartphone application 'Yorisou e Net' to version 2.8.0 or later for both Android and iOS to remove the hard-coded cryptographic key vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart