---
id: CVE-2026-54373
title: >-
  VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security
  Config
summary: >-
  VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a
  cleartext traffic vulnerability that allows network-based attackers to
  intercept or modify unencrypted HTTP communications due to the absence of an
  Android network se…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-319
vendor: 'Shenzhen Shine Industrial Co., Ltd.'
product: VitaFit
affected:
  - VitaFit < 2.8.1.0
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:51:30.751Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54373'
references:
  - url: 'https://github.com/je-lv/vitafit-security-research'
    label: Researcher Disclosure
  - url: 'https://play.google.com/store/apps/details?id=com.vt.vitafit'
    label: Google Play
  - url: >-
      https://www.vulncheck.com/advisories/vitafit-android-cleartext-traffic-via-missing-network-security-config
    label: >-
      VulnCheck Advisory: VitaFit Android < 2.8.1.0 Cleartext Traffic via
      Missing Network Security Config
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.626Z'
---

## Overview

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.

## Affected

- `VitaFit < 2.8.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.