Vehicle Inspection Certificate Viewer app may leak API credentials
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-201.
Summary
The Vehicle Inspection Certificate Viewer app from the Ministry of Land, Infrastructure, Transport and Tourism is affected through ver.6.2.0 on Android and iOS. The app includes sensitive information in data it transmits (CWE-201), which may expose API integration credentials such as an access ID and access key. A remote attacker with no privileges or user interaction may be able to obtain these credentials.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism | Vehicle Inspection Certificate Viewer (for Android) | up to ver.6.2.0 | — | No fix listed | CNA |
| Ministry of Land, Infrastructure, Transport and Tourism | Vehicle Inspection Certificate Viewer (for iOS) | up to ver.6.2.0 | — | No fix listed | CNA |
- Vehicle Inspection Certificate Viewer (for Android) VendorMinistry of Land, Infrastructure, Transport and Tourism Affected up to ver.6.2.0 Fixed in — No fix listed CNA
- Vehicle Inspection Certificate Viewer (for iOS) VendorMinistry of Land, Infrastructure, Transport and Tourism Affected up to ver.6.2.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Vehicle Inspection Certificate Viewer (for Android). The sources list no fixed version for Vehicle Inspection Certificate Viewer (for iOS).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-75559
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences