| タイトル | COINOMI LTD Coinomi <=1.7.6 Cleartext Transmission of Sensitive Information (information dis |
|---|
| 説明 | The Coinomi Android wallet communicated with its Electrum‑compatible backend over unencrypted TCP, causing the app to transmit wallet activity including the user’s full set of Bitcoin addresses in plaintext on app launch. An on‑path attacker (e.g., public Wi‑Fi, ISP, compromised router) could passively deanonymize the wallet, track balances and transactions by address, and correlate user activity. It will also transmit signed transactions unencrypted so sophisticated MITM replay attacks are possible resulting in loss of funds.
Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Justification:
AV:N – network.
AC:L with AT:P (Attack Requirements: Present) – on‑path position is modeled as a present precondition in v4.0.
PR:N, UI:N – as above.
VC:H – high confidentiality impact to the vulnerable system (full wallet address set exposed);
VI:N, VA:N – no demonstrated integrity/availability impact; no subsequent system impacts. |
|---|
| ソース | ⚠️ https://web.archive.org/web/20171013065745/https://github.com/Coinomi/coinomi-android/issues/213 |
|---|
| ユーザー | lukechilds (UID 88472) |
|---|
| 送信 | 2025年09月13日 17:32 (1 年 ago) |
|---|
| モデレーション | 2025年09月21日 11:08 (8 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 325143 [Coinomi 迄 1.7.6 弱い暗号化] |
|---|
| ポイント | 20 |
|---|