CVE-2016-6547 Zizai Tech Nut stores the account password in cleartext
The mobile app stores user passwords in cleartext, allowing attackers with device access to steal credentials and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6547?
CVE-2016-6547 is a high-severity vulnerability in Zizai Technology Tech Nut Mobile Application, published on 13 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
Which versions are affected by CVE-2016-6547?
It affects 1 product.
Products include Nutspace Nut Mobile.
How do I fix CVE-2016-6547?
No fix has been published for CVE-2016-6547 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6547 being exploited?
There is no known exploitation of CVE-2016-6547 in the wild and no public exploit code.
Other vulnerabilities in Zizai Technology Tech Nut Mobile Application
Sources
Also known as GHSA-jjww-q898-pqwc.