CVE-2016-6548: Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-13 · updated 2026-06-17
Weakness: CWE-200

Description

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.

Affected products

Nutspace Nut Mobile: all versions

References

https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/402847
https://www.securityfocus.com/bid/93877
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/402847
https://www.securityfocus.com/bid/93877

Get alerted when CVE-2016-6548 or the next vulnerability affects your stack