Cellebrite's vulnerability footprint concentrates in its mobile forensic acquisition platforms, particularly UFED and associated firmware components, which are specialized tools deployed in law enforcement and investigative contexts. The observed weakness class centers on hard-coded credentials, a characteristic exposure for embedded and field-deployed devices where credential management and firmware update mechanisms differ from standard enterprise practices. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cellebrite over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-14474HIGH The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypt | Jun 30, 2020 | 7.5 | 25 | NO | NO |
CVE-2020-11723MEDIUM Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place evidence onto target | Apr 14, 2020 | 5.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cellebrite.
Media articles that mention a CVE ID that affects a product developed by Cellebrite — matched by CVE ID, not by vendor name.