The vulnerability lies in the way the GEO CORPORATION "ゲオアプリ" stores user passwords in plaintext, allowing an attacker to read credentials directly from the device’s storage. This results in a compromise of user confidentiality, potentially enabling credential theft and unauthorized access to the user’s account and related services. The weakness aligns with CWE-312, which deals with the insecure storage of passwords in cleartext.

The affected products are GEO CORPORATION "ゲオアプリ" for Android and GEO CORPORATION "ゲオアプリ" for iOS. No specific version ranges are provided, so the vulnerability may be present across the available releases until the application is updated by the vendor. Users of either platform should verify whether the installed version is impacted.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation based on current data. The vulnerability is not listed in the CISA KEV catalog. While the description does not state the exact attack vector, the cleartext storage implies that a local attacker who can access the device’s file system, or an attacker who compromises the app binary or extracts data from the device, could obtain passwords. This may be achieved through direct device compromise, malware, or reverse engineering of the app’s storage format. No remote exploitation path is explicitly described. If the device is lost or stolen, the risk is heightened because the attacker can likely retrieve the stored passwords without additional credentials.