CVE-2026-4216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4216", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-15T15:09:22.212Z", "datePublished": "2026-03-16T05:02:08.472Z", "dateUpdated": "2026-03-16T18:45:09.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T05:02:08.472Z"}, "title": "i-SENS SmartLog App air.SmartLog.android hard-coded credentials", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-798", "lang": "en", "description": "Hard-coded Credentials"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-259", "lang": "en", "description": "Use of Hard-coded Password"}]}], "affected": [{"vendor": "i-SENS", "product": "SmartLog App", "versions": [{"version": "2.6.0", "status": "affected"}, {"version": "2.6.1", "status": "affected"}, {"version": "2.6.2", "status": "affected"}, {"version": "2.6.3", "status": "affected"}, {"version": "2.6.4", "status": "affected"}, {"version": "2.6.5", "status": "affected"}, {"version": "2.6.6", "status": "affected"}, {"version": "2.6.7", "status": "affected"}, {"version": "2.6.8", "status": "affected"}], "modules": ["air.SmartLog.android"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: \"The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-03-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-15T16:15:50.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.351140", "name": "VDB-351140 | i-SENS SmartLog App air.SmartLog.android hard-coded credentials", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.351140", "name": "VDB-351140 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770497", "name": "Submit #770497 | i-SENS SmartLog(air.SmartLog.android) 2.6.8 Developer Mode Credential Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Developer-Mode-Credential-Exposure-in-air-SmartLog-android-3182de3f97fb80f1abb7e958be2940fa?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T18:44:59.397464Z", "id": "CVE-2026-4216", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:45:09.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4216", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T18:44:59.397464Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:45:05.743Z"}}], "cna": {"title": "i-SENS SmartLog App air.SmartLog.android hard-coded credentials", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"vendor": "i-SENS", "modules": ["air.SmartLog.android"], "product": "SmartLog App", "versions": [{"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.6.3"}, {"status": "affected", "version": "2.6.4"}, {"status": "affected", "version": "2.6.5"}, {"status": "affected", "version": "2.6.6"}, {"status": "affected", "version": "2.6.7"}, {"status": "affected", "version": "2.6.8"}]}], "timeline": [{"lang": "en", "time": "2026-03-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-15T16:15:50.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351140", "name": "VDB-351140 | i-SENS SmartLog App air.SmartLog.android hard-coded credentials", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.351140", "name": "VDB-351140 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770497", "name": "Submit #770497 | i-SENS SmartLog(air.SmartLog.android) 2.6.8 Developer Mode Credential Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Developer-Mode-Credential-Exposure-in-air-SmartLog-android-3182de3f97fb80f1abb7e958be2940fa?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: \"The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "Hard-coded Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-259", "description": "Use of Hard-coded Password"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T05:02:08.472Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4216", "state": "PUBLISHED", "dateUpdated": "2026-03-16T18:45:09.497Z", "dateReserved": "2026-03-15T15:09:22.212Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T05:02:08.472Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["air.SmartLog.android"], "product": "SmartLog App", "vendor": "i-SENS", "versions": [{"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.6.3"}, {"status": "affected", "version": "2.6.4"}, {"status": "affected", "version": "2.6.5"}, {"status": "affected", "version": "2.6.6"}, {"status": "affected", "version": "2.6.7"}, {"status": "affected", "version": "2.6.8"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: \"The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it.\""}, {"lang": "es", "value": "Se ha identificado una debilidad en la aplicaci\u00f3n i-SENS SmartLog hasta la versi\u00f3n 2.6.8 en Android. Esto afecta a una funci\u00f3n desconocida del componente air.SmartLog.android. Esta manipulaci\u00f3n causa credenciales codificadas de forma r\u00edgida. El ataque solo puede ejecutarse localmente. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. El proveedor explica: 'La funci\u00f3n a la que se hace referencia en el informe existe actualmente en nuestro sistema desplegado. Est\u00e1 relacionada con un modo de desarrollador utilizado durante el proceso de configuraci\u00f3n para el emparejamiento Bluetooth entre el medidor de glucosa en sangre y la aplicaci\u00f3n SmartLog. Esta funci\u00f3n est\u00e1 destinada a fines de configuraci\u00f3n relacionados con la integraci\u00f3n y prueba de dispositivos. (...) [E]n una futura actualizaci\u00f3n de la aplicaci\u00f3n, planeamos revisar las medidas para eliminar la funci\u00f3n del modo de desarrollador o restringir el acceso a ella.'"}], "id": "CVE-2026-4216", "lastModified": "2026-06-17T10:56:14.263", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4216", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T18:44:59.397464Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:20:08.733", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351140"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351140"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.770497"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/Developer-Mode-Credential-Exposure-in-air-SmartLog-android-3182de3f97fb80f1abb7e958be2940fa?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-259"}, {"lang": "en", "value": "CWE-798"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.8"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SmartLog App", "source": "cna", "vendor": "i-SENS"}, "product": "smartlog_app", "vendor": "i-sens"}], "analysis": {"en": {"generated_at": "2026-03-17T12:08:31.535407+00:00", "value": {"mitigation_remediation": ["Verify if a newer SmartLog App release that removes the hard\u2011coded credentials is available and update to that version if it exists.", "If an update is not yet released, consider disabling any developer\u2011mode configuration functions in the app, if such a setting is exposed.", "Contact i\u2011SENS to confirm the patch schedule and whether the developer\u2011mode function will be removed or restricted in a future update.", "As a precaution, limit physical access to the device to reduce the opportunity for a local attacker to exploit the flaw."], "summary": {"action": "Apply Update", "impact": "Local credential exposure via hard\u2011coded credentials"}, "threat_synthesis": {"affected_systems": "Affected vendor: i\u2011SENS SmartLog App. Product component: air.SmartLog.android. All releases of the Android application up to version 2.6.8 are vulnerable. No specific Android OS or device versions are mentioned, so any device running the vulnerable app could be impacted.", "description_and_impact": "The vulnerability is the presence of hard\u2011coded credentials in the i\u2011SENS SmartLog App component air.SmartLog.android up to version 2.6.8 on Android, and it maps to CWE\u2011259 and CWE\u2011798. The flaw allows local authentication bypass for the application itself; the available description does not indicate further consequences such as data disclosure or tampering beyond the application\u2019s own use of the credentials.", "risk_and_exploitability": "The CVSS score of 4.8 places the vulnerability in the low severity range. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is local only; an exploit is publicly available that extracts the embedded credentials, but no remote code execution or denial\u2011of\u2011service capabilities are described."}}}}, "created": "2026-03-17T09:55:02.530747+00:00", "updated": "2026-03-24T10:45:50.391883+00:00", "vendors": ["i-sens", "i-sens$PRODUCT$smartlog_app"]}