Voicetra Voice Translator For Android
Monthly
VoiceTra, a voice translation mobile application developed by Japan's National Institute of Information and Communications Technology (NICT), fails to correctly validate the destination server for its translation API communications (CWE-941), affecting both Android and iOS versions across all releases. An attacker capable of intercepting or redirecting the app's network traffic can substitute a malicious server, enabling theft of spoken or typed translation input and delivery of falsified translation output to the user. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the network-accessible attack vector and zero-privilege attacker requirement make opportunistic exploitation plausible in hostile Wi-Fi environments.
VoiceTra, a voice translation mobile application developed by Japan's National Institute of Information and Communications Technology (NICT), fails to correctly validate the destination server for its translation API communications (CWE-941), affecting both Android and iOS versions across all releases. An attacker capable of intercepting or redirecting the app's network traffic can substitute a malicious server, enabling theft of spoken or typed translation input and delivery of falsified translation output to the user. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the network-accessible attack vector and zero-privilege attacker requirement make opportunistic exploitation plausible in hostile Wi-Fi environments.