CVE-2021-36460

HIGH 7.8CVE-2021-36460 · Published 25/04/2022 · updated 09/07/2026

In short

CVE-2021-36460 is a HIGH (CVSS 7.8) vulnerability affecting veryfitpro (veryfitpro project).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 30.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
veryfitpro veryfitpro_project	`≤ 3.3.7`	No fix yet

Description

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.

References

i-doo.cn · Not Applicable
martinfrancois/CVE-2021-36460 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free