CVE-2020-27416 Mahavitaran Android Application: Account take over via OTP bypass

Vulnerable Software: Maharashtra State Electricity Board Android Application

Vulnerability: Account take over via OTP bypass

Affected Version: 7.50 and prior

Patched: Yes

Vendor Homepage:

App store link:

CVE: CVE-2020-27416

CVE Author: Tejas Nitin Pingulkar

Exploit Available: POC Available

About Affected Software

The Official App for Consumer by Mahavitaran ( M.S.E.D.C.L.). Mahavitaran
Consumer App enables consumers to avail Mahavitaran services at his/her
fingertips. The app is simple and easy to use. It provides transparency
in delivering services to consumers.

►Features :

*View and Pay bill
*Register and Track complaints
*View Bill and Payment history
*Manage Multiple Electricity Connections
*Contact 24 x7 MSEDCL Call Center
*Apply for New Connection
* Know the status of New Connection Application and Pay Estimate Charges
*Submit Meter Reading to avoid average billing
*Provide Feedback about Mahavitaran Services
*Update Contact Details ( Mobile Number & E-mail ID ) of consumer
*Find MSEDCL offices and collection centers near you
*Estimate your monthly electricity consumption and bill amount
*Get Information about the Feeder from where the power supply is provided to your connection
*Apply for the change of name
*Submit an application for addition/reduction in load


Intercept traffic via proxy application such as burp
Click on forget password
enter userid 
enter any number as OTP
Manumulate response in proxy change “valid” : true

enter password of your choice, you just got access to user account.


CVE-2020-27416 Mahavitaran Android Application: Account take over via OTP bypass

Leave a Reply

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to top