The Mobile application 'Vehicle Inspection Certificate Viewer' contains a flaw that can cause sensitive information to be included in transmitted data, potentially exposing API integration credentials such as Access ID and Key. This vulnerability is categorized as Information Exposure (CWE-201). An attacker who gains access to the transmitted payload could harvest these credentials and impersonate legitimate API consumers, leading to unauthorized data retrieval or manipulation.

Ministry of Land, Infrastructure, Transport and Tourism: Vehicle Inspection Certificate Viewer for Android and iOS. The affected versions are not specified in the advisory; users should verify the installed version against the latest release.

The CVSS score of 6.9 indicates a moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Although the attack surface is the application’s network traffic, the likely vector is interception of non‑encrypted data or misuse of improperly protected credentials; the flaw requires the application to transmit credentials inside outbound traffic which could be captured by a man‑in‑the‑middle or by a device physically compromised.