Cyber Resilience

CVE-2024-34897

High

Published: 03 February 2025

Published
03 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0028 51.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-34897 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Nedis SmartLife (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked in the top 48.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-34897 is an API key disclosure vulnerability, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), affecting the Nedis SmartLife Android app version 1.4.0. The vulnerability was published on 2025-02-03 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its potential for significant confidentiality impact.

A remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no authentication privileges, no user interaction, and without changing the scope of impact. Exploitation leads to high confidentiality consequences, enabling the disclosure of a sensitive API key from the affected app.

Mitigation guidance and additional details are available in vendor and research resources, including the Nedis website at http://nedis.com and a document from KTH Royal Institute of Technology at https://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-359419. Security practitioners should consult these for patching or workaround recommendations specific to the Nedis SmartLife app.

EU & UK References

Vulnerability details

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.

CWE(s)
CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Direct exposure of API key enables unsecured credential access (T1552).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-48310Shared CWE-200
CVE-2025-24899Shared CWE-200
CVE-2026-46427Shared CWE-200
CVE-2025-26001Shared CWE-200
CVE-2024-48125Shared CWE-200
CVE-2026-32609Shared CWE-200
CVE-2026-45091Shared CWE-200
CVE-2025-62188Shared CWE-200
CVE-2024-50338Shared CWE-200
CVE-2026-25146Shared CWE-200

Affected Assets

Nedis
SmartLife
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
preventrecover

Directly requires timely identification, reporting, and correction of the API key disclosure flaw in the Nedis SmartLife Android app.

AU-13 Monitoring for Information Disclosure good match
detect

Specifically monitors the system for unauthorized disclosure of sensitive information such as the exposed API key.

SC-28 Protection of Information at Rest partial match
prevent

Protects the confidentiality of the sensitive API key at rest within the Android app using cryptographic mechanisms to mitigate extraction risks.

References