Security readout for executives and security teams
Plain-English summary
MobileIron mobile agents contained a hardcoded API key used for the MobileIron SaaS discovery API. Public reporting says this could support account enumeration. The vendor described the related feature as opt-in, disabled by default, and only enabled through support, which limits likely exposure.
Executive priority
Treat this as a configuration-dependent exposure issue, not a confirmed widespread compromise. Priority is higher for MobileIron customers that enabled SaaS discovery or cannot prove it is disabled.
Technical view
CVE-2020-35137 concerns MobileIron Android and iOS agents through 2021-03-22, including Mobile@Work. The embedded key was reported in RegisterActivity.java and used for MobileIron SaaS discovery API requests. Sources do not provide CVSS, CWE, exact fixed versions, or a vendor patch.
Likely exposure
Most relevant to organizations using MobileIron mobile agents and the SaaS discovery feature. Vendor notes say the feature is not enabled by default and requires explicit support enablement, so exposure depends on customer configuration.
Exploitation context
The CVE is not in KEV, and the provided sources do not claim active exploitation. Public references include research and a GitHub project, indicating public technical knowledge exists, but exploitation in the wild is not evidenced here.
Researcher notes
Evidence is limited. NVD-style metadata lists unknown severity and no affected CPEs. The strongest technical claims are the hardcoded key, API purpose, affected mobile agents through 2021-03-22, and vendor opt-in statement.
Mitigation direction
- Confirm whether MobileIron SaaS discovery was enabled for your tenant.
- Ask MobileIron support for current guidance and any compensating controls.
- Inventory Android and iOS MobileIron agents deployed before 2021-03-22.
- Monitor related SaaS discovery API activity for unusual enumeration patterns.
- Limit exposure of MobileIron tenant discovery information where configurable.
Validation and detection
- Check support records for any request enabling the opt-in discovery feature.
- Review MDM inventory for Mobile@Work or MobileIron agents in scope.
- Ask the vendor whether deployed agent versions still contain the key.
- Review logs for unexpected discovery API lookups tied to your tenant.
- Document whether the feature is disabled, enabled, or unknown.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-35137 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.