CVE-2021-25266

LOW 3.9CVE-2021-25266 · Published 27/04/2022 · updated 17/06/2026

In short

CVE-2021-25266 is a LOW (CVSS 3.9) vulnerability affecting authenticator (sophos), intercept x (sophos).
Chance of exploitation in the next 30 days (EPSS): 0.23%, higher than 14.3% of all vulnerabilities.
Fix: update to 9.7.3495 or later.

Package	Affected versions	Patched versions
authenticator sophos	`≤ 3.4`	No fix yet
intercept x sophos	`< 9.7.3495`	`9.7.3495`

Description

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.

References

sophos.com/en-us/security-advisories/sophos-sa-20220427-ixm-storage · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free