CVE-2024-0390 is a critical severity (CVSS 9.8) flaw in the INPRAX iZZi connect Android app. The app ships hard-coded MQTT queue credentials that the physical reQnet iZZi recuperation units also use. Versions before 2024010401 are affected. Update the app to 2024010401 or later.
What's affected
The iZZi connect application for Android from INPRAX sp. z o.o., all versions below 2024010401. The record's product entry is the Android build of the app, not the recuperation unit firmware.
CERT Polska coordinated the report and published its advisory on 15 February 2024. It says the vendor confirmed the weakness and that the fix shipped in version 2024010401, released on 8 January 2024. The weakness is CWE-798, use of hard-coded credentials.
Severity: the record gives CVSS 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CERT Polska advisory states the vulnerable versions and the fix but does not print a score, so there is no second figure to compare against. The record is not on the CISA Known Exploited Vulnerabilities list, and neither source reports exploitation.
How to check if you're exposed
You are exposed if the iZZi connect app is installed and its version is older than 2024010401. On an Android phone, open the system settings, find the app in the list of installed apps and read the version shown on its info page. Compare it with 2024010401.
If you manage a fleet of phones, use your mobile device management tool to list the installed version of the app on each device.
The advisory describes shared credentials, so the question is wider than one phone. Anyone who ever held an older copy of the app could have extracted the same credentials. Treat that as a reason to move quickly on the update rather than as proof that anything happened.
What to do now
- Update iZZi connect to version 2024010401 or later on every device that uses it.
- Remove old copies of the app, including any sideloaded package files kept for convenience.
- Check the INPRAX or CERT Polska notice for anything further the vendor asks owners of the reQnet iZZi unit to do. Neither source we read lists extra steps for owners.
- Check the settings of the recuperation unit for values you did not set. The advisory says the credentials could allow reading and managing parameters of the unit.
- If you build mobile apps, search your own packages for embedded secrets before release, and issue per user or per device credentials instead of one shared secret.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan will not inspect an Android app package for embedded secrets, but it does cover the libraries your own projects pull in.
Why it matters
A hard-coded credential is a secret that everyone who has the app also has. Anyone can unpack an app package and read it. Here the same MQTT queue serves the app and the physical devices, so one leaked secret reaches every connected unit that uses that queue, not one account.
The advisory language is careful: it says exploitation "could potentially allow" unauthorized access to manage and read parameters of the unit. That fits the vector, which needs no privileges and no user interaction over the network. The practical lesson for builders is that rotating a baked-in credential means shipping a new app version, which is why the fix needed a release.
Quick check
Is CVE-2024-0390 exploited in the wild?
The record is not flagged in the CISA Known Exploited Vulnerabilities catalog and the CERT Polska advisory does not report exploitation.
Which version fixes CVE-2024-0390?
CERT Polska says the fix is in iZZi connect version 2024010401, released on 8 January 2024.
Sources
Last reviewed: 19 October 2026.
