TI-2022-17824 Aliases CVE-2022-38117 GHSA-2wjq-7fcc-4p8f

Juiker app - Hard-coded Credentials

LOW 27CWE-798Published 2022-10-24 · Updated 2025-05-07

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00296 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Juiker	Juiker app	4.6.0311.1	—	No fix listed	CNA

Juiker app VendorJuiker Affected 4.6.0311.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:juiker:juiker:4.6.0311.1:::::android::	4.6.0311.1	Vulnerable	Juiker

cpe:2.3:a:juiker:juiker:4.6.0311.1:*:*:*:*:android:*:* Versions 4.6.0311.1 Vulnerable ·Juiker

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-38117
2026-10-03 Alias added: GHSA-2wjq-7fcc-4p8f

References

Advisory 1

https://www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html

TI-2014-05532 The Juiker (aka org.itri) application 3.2.0829.1 for Android does not verify X.509… CVSS 2.0MEDIUM 5.4
TI-2022-18435 Juiker app - Information Leakage CVSS 3.1LOW 2.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences