Description
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.
Published: 2026-11-04
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Unencrypted HTTP traffic allows interception and modification of app data
Action: Immediate Patch
AI Analysis

Impact

The application lacks an Android network security configuration, causing all traffic to be transmitted unencrypted. This flaw, identified as CWE‑319, lets attackers on an untrusted network eavesdrop on or tamper with HTTP communications. As a result, confidential user information and support content can be intercepted or altered, potentially leading to a loss of data confidentiality and integrity.

Affected Systems

VitaFit Android (com.vt.vitafit) built by Shenzhen Shine Industrial Co., Ltd. in any version prior to 2.8.1.0 is vulnerable.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS information is unavailable but the vulnerability can be exploited by any entity that can establish a network connection to the device, making it accessible to local or remote attackers on untrusted networks. It is not listed in the CISA KEV catalog, yet the potential for data exposure remains significant.

Generated by OpenCVE AI on November 4, 2026 at 23:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the VitaFit application to version 2.8.1.0 or later, which implements a network security configuration that restricts communication to HTTPS only.
  • If an update is not immediately possible, modify the app’s network security policy (or use a custom TLS socket factory) to enforce HTTPS and prohibit cleartext traffic.
  • For devices that cannot be patched, block HTTP traffic at the perimeter firewall or use network segmentation to isolate the application’s traffic from untrusted networks.

Generated by OpenCVE AI on November 4, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
Description VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.
Title VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
Weaknesses CWE-319
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-04T21:51:30.751Z

Reserved: 2026-06-12T20:20:02.948Z

Link: CVE-2026-54373

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T22:18:04.873

Modified: 2026-11-04T22:18:04.873

Link: CVE-2026-54373

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T23:30:12Z

Weaknesses
  • CWE-319

    Cleartext Transmission of Sensitive Information