PT-2017-13484 · Vibease · Vibease Wireless Remote Vibrator+1

Published 2017-12-01 · Updated 2019-10-03 · CVE-2017-14486

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vibease Wireless Remote Vibrator app for Android (affected versions not specified) Vibease Chat app for iOS (affected versions not specified)

Description The issue allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic, due to the use of cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers.

Recommendations For the Vibease Wireless Remote Vibrator app for Android, consider disabling the PLAIN SASL mechanism until a secure authentication method is implemented. For the Vibease Chat app for iOS, avoid using the app to send sensitive information over unsecured networks until the issue is resolved. As a temporary workaround, restrict access to the XMPP traffic to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-14486

Affected Products

Vibease Chat

Vibease Wireless Remote Vibrator

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-14486 · Security Note
• https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat · Note