« Volver al listado

CVE-2025-27839

Estado: AplazadaBaja (3.2)—

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tangem — SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27839",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27839",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-10T17:19:00.674527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.2,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Tangem",
          "product": "SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.18.3",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-08T00:15:38.340",
  "references": [
    {
      "url": "https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://tangem.com/en/blog/post/app-update/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1025"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible."
    },
    {
      "lang": "es",
      "value": "operations/attestation/AttestationTask.kt en el SDK de Tangem anterior a la versión 5.18.3 para Android tiene un flujo lógico en la certificación de billetera sin conexión (verificación de autenticidad) que hace que los resultados de la verificación se ignoren durante el primer escaneo de una tarjeta. Es posible que no haya sido posible explotarlo."
    }
  ],
  "lastModified": "2026-06-17T09:04:19.233",
  "sourceIdentifier": "cve@mitre.org"
}