CVEvulnerability

CVE-2020-25493

7.5 HIGH Published 2021-02-11 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2021-02-11
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-327, CWE-798

Description

Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.

Affected configurations

• oclean oclean 2.1.2

Related

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References