{"id":"CVE-2026-54373","kind":"vulnerability","aliases":["CVE-2026-54373"],"related":[],"title":"VitaFit Android app sends unencrypted HTTP traffic, allowing content tampering","description":"VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 sends some traffic over cleartext HTTP because it has no Android network security configuration. An attacker on the same untrusted network can read or modify that traffic, including support content shown to the user.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other","vitafit"],"not_affected_if":["app-not-installed","fixed-version"],"how_to_check":"- Check the installed app version for package `com.vt.vitafit`; versions before `2.8.1.0` are affected.\n- Review the app's network security configuration for cleartext traffic permissions (unknown if the sources give a specific file or setting).","fix":"- VitaFit Android app: move to `2.8.1.0` or later (per the NVD range before 2.8.1.0).","status":"open","published_at":"2026-11-04T22:18:04+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:10:08+00:00","updated_at":"2026-11-04T23:10:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T23:10:08Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit Android app: move to `2.8.1.0` or later (per the NVD range before 2.8.1.0).","reach":"network","title":"VitaFit Android app sends unencrypted HTTP traffic, allowing content tampering","impact":"low","summary":"The VitaFit Android app (com.vt.vitafit) before 2.8.1.0 sends some traffic over cleartext HTTP because it has no Android network security configuration. An attacker on the same untrusted network can read or modify that traffic, including support content shown to the user.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","vitafit","mobile"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker alters unencrypted app traffic and changes support content shown to users","analyst_note":"","how_to_check":"- Check the installed app version for package `com.vt.vitafit`; versions before `2.8.1.0` are affected.\n- Review the app's network security configuration for cleartext traffic permissions (unknown if the sources give a specific file or setting).","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","needs_analyst":false,"not_affected_if":["fixed-version","app-not-installed"],"who_is_affected":"Users of the VitaFit Android app older than 2.8.1.0 are exposed, mainly when on untrusted networks such as public Wi-Fi. The flaw is in the app's traffic handling, so the attacker needs to be on the network path between the app and its server. Users on the fixed version or who do not use the app can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4290,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54373':13A,16A '2.8.1.0':27B,67C 'absenc':89C 'allow':8A,74C 'android':2A,17B,23B,38B,63C,92C 'app':3A,24B,117C 'applic':64C 'attack':43B,78C,96C 'base':77C 'cleartext':32B,70C 'com.vt.vitafit':25B,65C 'communic':85C 'configur':41B,95C 'contain':68C 'content':9A,57B,104C 'cve':11A,14A 'display':105C 'due':86C 'http':6A,33B,84C,113C 'includ':55B 'intercept':80C 'manipul':102C 'mobil':18B 'modifi':52B,82C 'network':39B,48B,76C,93C,100C 'network-bas':75C 'read':50B 'secur':40B,94C 'send':4A,28B 'server':119C 'shown':58B 'support':56B,103C 'tamper':10A,110C 'traffic':7A,30B,54B,71C,114C 'unencrypt':5A,83C,112C 'untrust':47B,99C 'user':61B,108C 'vitafit':1A,20B,22B,62C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Users of the VitaFit Android app older than 2.8.1.0 are exposed, mainly when on untrusted networks such as public Wi-Fi. The flaw is in the app's traffic handling, so the attacker needs to be on the network path between the app and its server. Users on the fixed version or who do not use the app can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the VitaFit app on your Android phone to version 2.8.1.0 or later.","pkeys":[],"ptokens":[],"labels":["android","medium","mobile","other","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54373","severity":null,"published_at":"2026-11-04T22:18:04+00:00","modified_at":"2026-11-04T22:18:04+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[{"id":71152,"url":"https://www.vulncheck.com/advisories/vitafit-android-cleartext-traffic-via-missing-network-security-config","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}