CVE-2020-25493 Weak cryptography in n/a
An attacker can eavesdrop on network traffic and decrypt data using a hardcoded XOR key in the Oclean mobile application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25493?
CVE-2020-25493 is a high-severity vulnerability in n/a, published on 11 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.
Which versions are affected by CVE-2020-25493?
It affects 1 product.
Products include Oclean Oclean.
How do I fix CVE-2020-25493?
No fix has been published for CVE-2020-25493 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25493 being exploited?
There is no known exploitation of CVE-2020-25493 in the wild and no public exploit code.
Sources
Also known as GHSA-mf96-wwv9-c857.