CVE-2025-27839

March 8, 2025, 12:15 a.m.

3.2
Low

Description

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible.

Product(s) Impacted

Product Versions
Tangem SDK for Android
  • ['before 5.18.3']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1025
Comparison Using Wrong Factors
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

References

https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07
https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409
https://tangem.com/en/blog/post/app-update/

Tags

cve@mitre.org
CWE-1025
2025-03-08
CVE-2025-27839

CVSS Score

3.2 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

    View Vector String

Timeline

Published: March 8, 2025, 12:15 a.m.
Last Modified: March 8, 2025, 12:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.