CVE-2017-15998

High

Published: 29/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The 'NQ Contacts Backup & Restore' application version 1.1 for Android uses DES encryption with a static key to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.

Risk Assessment

The use of a static encryption key exposes contact data to interception by attackers, potentially leading to the disclosure of sensitive information.

Recommendation

It is recommended to update the application to a version that employs stronger encryption methods and dynamic keys to enhance the security of transmitted data.

Other vulnerabilities in NQ Contacts Backup & Restore 1.1 for Android

CVE-2017-15999Critical
In the 'NQ Contacts Backup & Restore' application version 1.1 for Android, HTTPS is not used for transmitting login and synced user data. The username is transmitted in cleartext along with an SHA-1 hash of the password.

Original NVD description (English source)

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.