CVE-2017-15999

CRITICAL 9.8CVE-2017-15999 · Published 29/10/2017 · updated 17/06/2026

In short

CVE-2017-15999 is a CRITICAL (CVSS 9.8) vulnerability affecting contacts backup & restore (nq).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
contacts backup & restore nq	`= 1.1`	No fix yet

Description

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.

References

1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html · Third Party Advisory

More vulnerabilities in contacts backup & restore

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free