CVE-2017-14486 Weak cryptography in n/a
Attackers can sniff network traffic to steal user credentials and messages from Vibease apps due to cleartext transmission and weak authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14486?
CVE-2017-14486 is a high-severity vulnerability in n/a, published on 1 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic.
Weakness: CWE-319
Which versions are affected by CVE-2017-14486?
It affects 2 products.
Products include Vibease Chat, Vibease Wireless Remote Vibrator.
How do I fix CVE-2017-14486?
No fix has been published for CVE-2017-14486 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-14486 being exploited?
There is no known exploitation of CVE-2017-14486 in the wild and no public exploit code.
Sources
Also known as GHSA-x7m9-39j4-mh2q.