Information Disclosure Vulnerability in Tinxy
Priority LOW 25CWE-312Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00154 4th percentileScored 2026-11-07
Fix Fixed Tinxy Android app (Mogify Infotech): 663000Tinxy iOS app (Mogify Infotech): 6.7.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mogify Infotech | Tinxy Android app | before 663000 | 663000 | Patch available | CNA |
| Mogify Infotech | Tinxy iOS app | before 6.7.0 | 6.7.0 | Patch available | CNA |
- Tinxy Android app VendorMogify Infotech Affected before 663000 Fixed in 663000 Patch available CNA
- Tinxy iOS app VendorMogify Infotech Affected before 6.7.0 Fixed in 6.7.0 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mogify_infotech:tinxy_mobile_app:*:*:*:*:*:*:*:* | — | — | Mogify Infotech |
- cpe:2.3:a:mogify_infotech:tinxy_mobile_app:*:*:*:*:*:*:*:* Versions — — ·Mogify Infotech
Remediation
- Fix · CNA Tinxy Android app (Mogify Infotech) Fixed in 663000
- Fix · CNA Tinxy iOS app (Mogify Infotech) Fixed in 6.7.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12094
- 2026-10-03 Alias added: GHSA-3x9j-7f53-54f5
References
More Mogify Infotech vulnerabilities
- TI-2025-01919 Information Disclosure Vulnerability in Tinxy Smart Devices CVSS 4.0MEDIUM 5.1
Sources
- CVE-2024-12094 · CVE Program
- CVE-2024-12094 · NVD
- FIRST EPSS
- GHSA-3x9j-7f53-54f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences