CVE-2026-54373

Received Received - Intake

Cleartext Traffic Vulnerability in VitaFit Android App

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54373

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

The VitaFit Android app (com.vt.vitafit) before version 2.8.1.0 has a cleartext traffic vulnerability. This means the app sends and receives data over HTTP instead of HTTPS, allowing attackers on the same network to intercept or alter unencrypted communications. Without proper network security settings, support content shown to users can be manipulated by tampering with this traffic.

Detection Guidance

Detect this vulnerability by checking if the VitaFit app (com.vt.vitafit) version is below 2.8.1.0. Use Android package manager commands like 'adb shell dumpsys package com.vt.vitafit | grep versionCode' to verify the installed version.

Impact Analysis

Attackers on an untrusted network (like public Wi-Fi) could intercept sensitive data or modify support content displayed in the app. This could lead to misinformation, phishing attempts, or exposure of user interactions with the app.

Compliance Impact

This vulnerability may violate GDPR and HIPAA requirements for secure data transmission. Cleartext traffic risks unauthorized access to personal or health-related data, potentially leading to non-compliance with data protection regulations.

Mitigation Strategies

Update the VitaFit app to version 2.8.1.0 or later from the official app store. Avoid using untrusted networks for sensitive activities. Configure network security settings to enforce HTTPS-only traffic if possible.

Hi! I’m here to help you understand CVE-2026-54373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...