Critical severity9.8NVD Advisory· Published Mar 29, 2021· Updated Jun 17, 2026
CVE-2020-35138
CVE-2020-35138
Description
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<=2021-03-22+ 2 more
- (no CPE)range: <=2021-03-22
- cpe:2.3:a:mobileiron:mobile\@work:*:*:*:*:*:android:*:*range: <=2021-03-22
- cpe:2.3:a:mobileiron:mobile\@work:*:*:*:*:*:iphone_os:*:*range: <=2021-03-22
- Range: <=2021-03-22
Patches
Vulnerability mechanics
References
4- www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumerationnvdExploitThird Party Advisory
- www.optiv.com/insights/source-zero/blog/mobileiron-mdm-contains-static-key-allowing-account-enumerationnvdExploitThird Party Advisory
- play.google.com/store/apps/detailsnvdProductThird Party Advisory
- www.ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-researchnvdThird Party Advisory
News mentions
0No linked articles in our index yet.