The smartphone application Yorisou e Net contains a hard‑coded cryptographic key, which could be extracted by an attacker. The key is used for cryptographic functions, and its disclosure may allow unauthorized decryption or tampering of data handled by the app. While the vulnerability does not directly enable code execution or denial of service, it compromises the confidentiality of the cryptographic material and any information protected by it. This weakness is classified as CWE‑321, implying a reliance on a fixed key that can be readily discovered. The likely attack vector is local access to the application binary or memory, inferred from the necessity to extract the key, but this is not explicitly stated.

Tohoku Electric Power Company’s Yorisou e Net Android and iOS mobile applications are affected. No specific version numbers are listed, so all releases that include the hard‑coded key are vulnerable until a patch is released.

The CVSS score of 2.4 indicates low severity, reflecting that the vulnerability alone does not lead to remote exploitation of system resources. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Attackers would need access to the app’s binary or memory to extract the key, which is a relatively non‑trivial but possible action for local or remote code execution on the device. Based on the description, it is inferred that the likely attack vector involves local or remote access to the device's memory or storage to retrieve the key, which is not explicitly detailed. The overall risk is low but should be mitigated to prevent potential key compromise.