VitaFit CVE-2026-54373

Exploitation requires the attacker to hold an adjacent-network man-in-the-middle position (AV:A) between the VitaFit app and its server, and the victim must actively be using the app over that untrusted network (UI:P). The specific precondition is the app's absence of an Android network security configuration, which permits cleartext HTTP communication that the attacker can read and rewrite; the trigger is the app sending/receiving support content over unencrypted HTTP. Limiting factors: no remote internet-wide reach (not AV:N), no authentication is bypassed and no credentials are exposed (confidentiality impact is N), impact is confined to tampering with displayed support content (integrity-low), and it affects versions before 2.8.1.0. Users on trusted networks or on patched builds (2.8.1.0 and later) are not exposed.

This is a genuinely medium-severity, low-urgency issue rather than a high-priority emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:P, VI:L only) tells a consistent story: the attacker must be on the same adjacent/local network as the victim (AV:A, not AV:N), the only impact is low integrity (VI:L) - tampering with support content shown in-app - with no confidentiality (VC:N) or availability (VA:N) impact, and passive user interaction is needed (UI:P, the user must be using the app over the hostile network). No EPSS score and no CISA KEV listing are present in the input, and the vuln.today decision label is 'this_month' (routine patch cadence), all of which argue against widespread or active exploitation. The one PoC reference (a GitHub security-research repo) is explicitly 'reference only, not verified as working exploit code,' so it should not be treated as a weaponized exploit. The signals are mutually consistent, not conflicting: a real but limited integrity-only flaw requiring a privileged network position. Note the absence of EPSS data means statistical exploitation probability cannot be assessed from this input.

A victim uses the VitaFit app while connected to an attacker-controlled or compromised network (e.g., open Wi-Fi). Because the app lacks an Android network security configuration and permits cleartext HTTP, the attacker performs a man-in-the-middle and rewrites the unencrypted support content the server returns, displaying manipulated information to the user. A public PoC reference exists but is not verified as working exploit code.