What’s Vulnerable › Vulnerabilities

CVE-2017-14487

• Severity: critical (CVSS 9.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-01 · updated 2026-06-17
• Weakness: CWE-290

Description

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.

Affected products

• Ohmibod Remote: before 2.50.37 — fixed in 2.50.37

How to fix

Upgrade to a fixed version: Ohmibod Remote 2.50.37. Check the vendor advisory for mitigations.

References

• https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat
• https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat

Get alerted when CVE-2017-14487 or the next vulnerability affects your stack