Vulnerability Description
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nutspace | Nut Mobile | - |
Related Weaknesses (CWE)
References
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulExploitThird Party Advisory
- https://www.kb.cert.org/vuls/id/402847Third Party AdvisoryUS Government Resource
- https://www.securityfocus.com/bid/93877Third Party AdvisoryVDB Entry
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulExploitThird Party Advisory
- https://www.kb.cert.org/vuls/id/402847Third Party AdvisoryUS Government Resource
- https://www.securityfocus.com/bid/93877Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-6548?
CVE-2016-6548 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the...
How severe is CVE-2016-6548?
CVE-2016-6548 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-6548?
Check the references section above for vendor advisories and patch information. Affected products include: Nutspace Nut Mobile.