Vulnerability Report

CVE-2017-14486

Title: Vibease Wireless Remote Vibrator Cryptographic Failures

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2017-14486.

CWE Category CWE-319

Published Date Dec 01, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.0

Exploit Probability (EPSS)

0.84%

Vulnerability Summary

CVE-2017-14486: The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic.

Impacted Vendors

vibease 2

egain 1

Reference Links

https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns