| Título | COINOMI LTD Coinomi <=1.7.6 Cleartext Transmission of Sensitive Information (information dis |
|---|
| Descrição | The Coinomi Android wallet communicated with its Electrum‑compatible backend over unencrypted TCP, causing the app to transmit wallet activity including the user’s full set of Bitcoin addresses in plaintext on app launch. An on‑path attacker (e.g., public Wi‑Fi, ISP, compromised router) could passively deanonymize the wallet, track balances and transactions by address, and correlate user activity. It will also transmit signed transactions unencrypted so sophisticated MITM replay attacks are possible resulting in loss of funds.
Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Justification:
AV:N – network.
AC:L with AT:P (Attack Requirements: Present) – on‑path position is modeled as a present precondition in v4.0.
PR:N, UI:N – as above.
VC:H – high confidentiality impact to the vulnerable system (full wallet address set exposed);
VI:N, VA:N – no demonstrated integrity/availability impact; no subsequent system impacts. |
|---|
| Fonte | ⚠️ https://web.archive.org/web/20171013065745/https://github.com/Coinomi/coinomi-android/issues/213 |
|---|
| Utilizador | lukechilds (UID 88472) |
|---|
| Submissão | 13/09/2025 17h32 (há 1 Ano) |
|---|
| Moderação | 21/09/2025 11h08 (8 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 325143 [Coinomi até 1.7.6 Encriptação fraca] |
|---|
| Pontos | 20 |
|---|