A potential security vulnerability caused by the use of insecure (http) transactions…
Priority LOW 37CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions of the Isaac Mizrahi Smartwatch mobile app. HP has no access to customer data as a result of this issue.
Why it matters now
EPSS 0.01901 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Isaac Mizrahi | Isaac Mizrahi Smartwatch Mobile App | Isaac Mizrahi iOS app versions 1.0.2.10; 1.2.2.12; 1.3.7; and 1.4.8. Isaac Mizrahi Android app versions 1.0.201601214; 1.2.2016040820; 1.3.2016052319; 1.4.2016072601 | — | No fix listed | CNA |
- Isaac Mizrahi Smartwatch Mobile App VendorIsaac Mizrahi Affected Isaac Mizrahi iOS app versions 1.0.2.10; 1.2.2.12; 1.3.7; and 1.4.8. Isaac Mizrahi Android app versions 1.0.201601214; 1.2.2016040820; 1.3.2016052319; 1.4.2016072601 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.0.2.10:*:*:*:*:iphone_os:*:* | 1.0.2.10 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.0.201601214:*:*:*:*:android:*:* | 1.0.201601214 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.2.2.12:*:*:*:*:iphone_os:*:* | 1.2.2.12 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.2.2016040820:*:*:*:*:android:*:* | 1.2.2016040820 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.3.7:*:*:*:*:iphone_os:*:* | 1.3.7 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.3.2016052319:*:*:*:*:android:*:* | 1.3.2016052319 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.4.8:*:*:*:*:iphone_os:*:* | 1.4.8 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.4.2016072601:*:*:*:*:android:*:* | 1.4.2016072601 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.0.2.10:*:*:*:*:iphone_os:*:* Versions 1.0.2.10 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.0.201601214:*:*:*:*:android:*:* Versions 1.0.201601214 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.2.2.12:*:*:*:*:iphone_os:*:* Versions 1.2.2.12 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.2.2016040820:*:*:*:*:android:*:* Versions 1.2.2016040820 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.3.7:*:*:*:*:iphone_os:*:* Versions 1.3.7 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.3.2016052319:*:*:*:*:android:*:* Versions 1.3.2016052319 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.4.8:*:*:*:*:iphone_os:*:* Versions 1.4.8 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:isaac_mizrahi_smartwatch:1.4.2016072601:*:*:*:*:android:*:* Versions 1.4.2016072601 Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2748
- 2026-10-03 Alias added: GHSA-vv6v-7j34-7w7m
References
Sources
- CVE-2017-2748 · CVE Program
- CVE-2017-2748 · NVD
- FIRST EPSS
- GHSA-vv6v-7j34-7w7m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences