CVE-2016-6548
Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token
CVE-2016-6548 is a critical vulnerability (CVSS 9.8) in Nutspace Nut Mobile, published July 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.66%, the 89th percentile. No source names a fixed version.
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
- Record
CVE-2016-6548- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
- Record
CVE-2016-6548- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2016-7469 No score
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
- Record
EUVD-2016-7469- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m6fh-f3mr-6pvv
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain...
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
- Record
GHSA-m6fh-f3mr-6pvv- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |