CVE-2017-14486
Last modified
CVE-2017-14486 is a vulnerability of currently unknown severity. The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic.. EPSS estimates a 0.84% chance of exploitation in the next 30 days.
Description
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vibease | Chat | All versions |
| Vibease | Wireless Remote Vibrator | All versions |
References
- https://dl.acm.org/citation.cfm?id=3139942&preflayout=flatThird Party Advisory
- https://dl.acm.org/citation.cfm?id=3139942&preflayout=flatThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14486?
How severe is CVE-2017-14486?
How do I fix CVE-2017-14486?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-1448IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x…
- CVE-2017-14480In the MMM::Agent::Helpers::Network::clear_ip function in My…9.8
- CVE-2017-14481In the MMM::Agent::Helpers::Network::send_arp function in My…9.8
- CVE-2017-14482GNU Emacs before 25.3 allows remote attackers to execute arb…
- CVE-2017-14483flower.initd in the Gentoo dev-python/flower package before …
- CVE-2017-14484The Gentoo sci-mathematics/gimps package before 28.10-r1 for…
- CVE-2017-14487The OhMiBod Remote app for Android and iOS allows remote att…
- CVE-2017-14489The iscsi_if_rx function in drivers/scsi/scsi_transport_iscs…
- CVE-2017-1449IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote atta…
- CVE-2017-14491Heap-based buffer overflow in dnsmasq before 2.78 allows rem…9.8
- CVE-2017-14492Heap-based buffer overflow in dnsmasq before 2.78 allows rem…
- CVE-2017-14493Stack-based buffer overflow in dnsmasq before 2.78 allows re…
Are you affected by CVE-2017-14486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST