HCL Verse for Android is susceptible to an APK signing key check vulnerability
Priority LOW 33CWE-326Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-326.
Summary
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed HCL Verse for Android (HCL Software): 12.0.15
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HCL Software | HCL Verse for Android | before 12.0.15 | 12.0.15 | Patch available | CNA |
- HCL Verse for Android VendorHCL Software Affected before 12.0.15 Fixed in 12.0.15 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hcltech:verse:*:*:*:*:*:android:*:* | before 12.0.15 | Vulnerable | HCL Software |
- cpe:2.3:a:hcltech:verse:*:*:*:*:*:android:*:* Versions before 12.0.15 Vulnerable ·HCL Software
Remediation
- Fix · CNA HCL Verse for Android (HCL Software) Fixed in 12.0.15
Timeline
- 2026-10-02 Threatist record created from CVE-2020-4099
- 2026-10-03 Alias added: GHSA-pc4m-vcwh-9c5h
References
More HCL Software Verse vulnerabilities
- TI-2021-09181 Cross-site scripting in HCL Software Verse CVSS 3.1HIGH 8.3
- TI-2023-19101 HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability CVSS 3.1HIGH 8.3
- TI-2023-12599 HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2021-09164 An SSL certificate host verification vulnerability affects HCL Verse for Android CVSS 3.1MEDIUM 6.3
Sources
- CVE-2020-4099 · CVE Program
- CVE-2020-4099 · NVD
- FIRST EPSS
- GHSA-pc4m-vcwh-9c5h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences