CVE-2026-54373

LOW 3.5

VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.

CWE	CWE-319
Vendor	shenzhen shine industrial co., ltd.
Product	vitafit
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for shenzhen shine industrial co., ltd. vitafit

Be the first to know when new low vulnerabilities affecting shenzhen shine industrial co., ltd. vitafit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Shenzhen Shine Industrial Co., Ltd. / VitaFit

0 < 2.8.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/je-lv/vitafit-security-research play.google.com: https://play.google.com/store/apps/details?id=com.vt.vitafit vulncheck.com: https://www.vulncheck.com/advisories/vitafit-android-cleartext-traffic-via-missing-network-security-config

Credits

Jose Lomeli