TI-2016-05612 CVE-2016-6548 · GHSA-m6fh-f3mr-6pvv
Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token
Priority MEDIUM 48
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS.
No Zizai Technology vulnerabilities are listed in CISA KEV.
3 records in Nut Mobile · all components
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS.
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute.