An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Authenticator | Sophos | * | 3.4 (including) |
| Intercept_x | Sophos | * | 9.7.3495 (excluding) |