AL-KO Robolinho Update Software Hard-Coded AWS Keys Vulnerability

A vulnerability exists in AL-KO Robolinho Update Software version 8.0.21.0610, where hard-coded AWS Access and Secret keys allow unauthorized access to AL-KO's AWS bucket. These keys could potentially grant more access than the application itself, with at least read access to some objects in the bucket. While the vendor was notified of this issue, they did not respond with details about the vulnerability or its affected version range.

Impact

Exploitation of this vulnerability could lead to unauthorized access to AL-KO's AWS bucket, with the potential for greater access than what the application provides. At a minimum, the vulnerability allows read access to certain objects in the bucket.