Insecure Data Storage in Sophos Authenticator for Android and Intercept X for Mobile

CVE-2021-25266

What is CVE-2021-25266?

A vulnerability exists in Sophos Authenticator for Android and Intercept X for Mobile leading to insecure data storage. This weakness enables a physical attacker with root privileges to access Time-based One-Time Password (TOTP) secret keys from unlocked devices running affected versions. The vulnerability poses a risk to users who may unknowingly expose sensitive authentication data, making it essential for affected users to update their applications to mitigate the threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References