| عنوان | COINOMI LTD Coinomi <=1.7.6 Cleartext Transmission of Sensitive Information (information dis |
|---|
| الوصف | The Coinomi Android wallet communicated with its Electrum‑compatible backend over unencrypted TCP, causing the app to transmit wallet activity including the user’s full set of Bitcoin addresses in plaintext on app launch. An on‑path attacker (e.g., public Wi‑Fi, ISP, compromised router) could passively deanonymize the wallet, track balances and transactions by address, and correlate user activity. It will also transmit signed transactions unencrypted so sophisticated MITM replay attacks are possible resulting in loss of funds.
Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Justification:
AV:N – network.
AC:L with AT:P (Attack Requirements: Present) – on‑path position is modeled as a present precondition in v4.0.
PR:N, UI:N – as above.
VC:H – high confidentiality impact to the vulnerable system (full wallet address set exposed);
VI:N, VA:N – no demonstrated integrity/availability impact; no subsequent system impacts. |
|---|
| المصدر | ⚠️ https://web.archive.org/web/20171013065745/https://github.com/Coinomi/coinomi-android/issues/213 |
|---|
| المستخدم | lukechilds (UID 88472) |
|---|
| ارسال | 13/09/2025 05:32 PM (1 سنة منذ) |
|---|
| الاعتدال | 21/09/2025 11:08 AM (8 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 325143 [Coinomi حتى 1.7.6 تشفير ضعيف] |
|---|
| النقاط | 20 |
|---|