Read the docs
TI-2018-08779 Aliases CVE-2018-12240GHSA-4fpj-5v33-6x96

Hard-coded credentials in Symantec Norton Identity Safe for Android

Priority LOW 29CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likelihood of encrypted data being recovered without adequate credentials.

Why it matters now

EPSS 0.01117 66th percentileScored 2026-11-07
Fix Fixed Norton Identity Safe for Android (Symantec Corporation): 5.3.0.976

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Identity Safe for Androidbefore 5.3.0.9765.3.0.976Patch availableCNA
  • Norton Identity Safe for Android VendorSymantec Affected before 5.3.0.976 Fixed in 5.3.0.976 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:norton_password_manager:*:*:*:*:*:android:*:*before 5.3.0.976VulnerableSymantec
  • cpe:2.3:a:symantec:norton_password_manager:*:*:*:*:*:android:*:* Versions before 5.3.0.976 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Identity Safe for Android (Symantec Corporation) Fixed in 5.3.0.976

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12240
  2. 2026-10-03 Alias added: GHSA-4fpj-5v33-6x96

References

Advisory 1

  • TI-2018-12983 Norton Password Manager may be susceptible to an address spoofing issue. CVSS 3.0HIGH 7.5
  • TI-2018-12980 Cross-site scripting in Symantec Norton Password Manager CVSS 3.0MEDIUM 6.1
  • TI-2019-09544 Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences