CVE-2026-4243

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4243", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-15T20:48:26.368Z", "datePublished": "2026-03-16T15:02:07.721Z", "dateUpdated": "2026-03-16T18:18:28.414Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T15:02:07.721Z"}, "title": "La Nacion App app.lanacion.activity BuildConfig.java credentials storage", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-256", "lang": "en", "description": "Unprotected Storage of Credentials"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-255", "lang": "en", "description": "Credentials Management"}]}], "affected": [{"vendor": "n/a", "product": "La Nacion App", "versions": [{"version": "10.2.25", "status": "affected"}], "modules": ["app.lanacion.activity"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-15T21:53:32.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.351185", "name": "VDB-351185 | La Nacion App app.lanacion.activity BuildConfig.java credentials storage", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351185", "name": "VDB-351185 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771432", "name": "Submit #771432 | SA LA NACION LA NACION(app.lanacion.activity) 10.2.25 WebSocket Credential Leak", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T18:18:16.241233Z", "id": "CVE-2026-4243", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:18:28.414Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4243", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T18:18:16.241233Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:18:24.003Z"}}], "cna": {"title": "La Nacion App app.lanacion.activity BuildConfig.java credentials storage", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "modules": ["app.lanacion.activity"], "product": "La Nacion App", "versions": [{"status": "affected", "version": "10.2.25"}]}], "timeline": [{"lang": "en", "time": "2026-03-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-15T21:53:32.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351185", "name": "VDB-351185 | La Nacion App app.lanacion.activity BuildConfig.java credentials storage", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351185", "name": "VDB-351185 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771432", "name": "Submit #771432 | SA LA NACION LA NACION(app.lanacion.activity) 10.2.25 WebSocket Credential Leak", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "Unprotected Storage of Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-255", "description": "Credentials Management"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T15:02:07.721Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4243", "state": "PUBLISHED", "dateUpdated": "2026-03-16T18:18:28.414Z", "dateReserved": "2026-03-15T20:48:26.368Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T15:02:07.721Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["app.lanacion.activity"], "product": "La Nacion App", "vendor": "n/a", "versions": [{"status": "affected", "version": "10.2.25"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en la aplicaci\u00f3n La Naci\u00f3n 10.2.25 en Android. Esto afecta a una funci\u00f3n desconocida del archivo source/app/lanacion/clublanacion/BuildConfig.java del componente app.lanacion.activity. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento API_KEY_WEBSOCKET_CV puede llevar al almacenamiento no protegido de credenciales. El ataque solo puede ejecutarse localmente. Un alto nivel de complejidad est\u00e1 asociado con este ataque. La explotabilidad se dice que es dif\u00edcil. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4243", "lastModified": "2026-06-17T10:56:17.833", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4243", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T18:18:16.241233Z", "version": "2.0.3"}}]}, "published": "2026-03-16T15:16:26.963", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351185"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351185"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.771432"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}, {"lang": "en", "value": "CWE-256"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.2.25"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "La Nacion App", "source": "cna", "vendor": "n/a"}, "product": "la_nacion_app", "vendor": "la_nacion_app"}], "analysis": {"en": {"generated_at": "2026-03-17T12:35:33.104912+00:00", "value": {"mitigation_remediation": ["Update the La Nacion App to the latest published version that removes the insecure API key storage", "If no patch is available, manually delete the stored API_KEY_WEBSOCKET_CV value from the app\u2019s local data or disable WebSocket usage within the app", "Reinstall the application from a trusted source once a patched version is released", "Monitor the device for any signs of local credential access or abnormal WebSocket traffic"], "summary": {"action": "Patch", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "The affected system is La Nacion App version 10.2.25 running on Android devices. The vulnerability resides in an unknown function of source/app/lanacion/clublanacion/BuildConfig.java within the app.lanacion.activity component. No other vendors or product versions are listed as affected, and the vendor did not issue a public fix.", "description_and_impact": "A weakness in La Nacion App 10.2.25 allows manipulation of the argument API_KEY_WEBSOCKET_CV within BuildConfig.java to cause unprotected storage of WebSocket API keys. The exposure of these credentials results in confidentiality loss; an attacker could potentially use the leaked keys to establish unauthorized WebSocket connections to the app\u2019s backend. Based on the description, it is inferred that possession of these keys could enable further malicious activities, such as data exfiltration or unauthorized access to services, although the CVE itself does not explicitly document these downstream effects.", "risk_and_exploitability": "The CVSS score is 2, indicating low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can only be executed locally, requires high complexity, and is considered difficult to perform; however, exploit code has already been made public. While the overall risk is low to moderate, local device access would grant an attacker sensitive credentials that could be leveraged for further attacks. The lack of an official patch heightens the importance of mitigating the credential leakage proactively."}}}}, "created": "2026-03-17T09:52:41.316036+00:00", "updated": "2026-03-24T10:50:23.788612+00:00", "vendors": ["la_nacion_app", "la_nacion_app$PRODUCT$la_nacion_app"]}