---
cve: "CVE-2025-56608"
severity: "MEDIUM"
cvss: 4.2
epss: "32%"
vendor: "n/a"
kev: false
exploited: false
published: "2025-09-03 15:15:37"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T01:35:50+02:00"
---

# CVE-2025-56608

> 4.2 MEDIUM · 🧪 PoC

## Beschreibung

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-327** — Use of a Broken or Risky Cryptographic Algorithm
  The product uses a broken or risky cryptographic algorithm or protocol.

## Angriffsmuster (CAPEC)

- [CAPEC-20 — Encryption Brute Forcing](https://capec.mitre.org/data/definitions/20.html) _(Severity: Low)_
- [CAPEC-97 — Cryptanalysis](https://capec.mitre.org/data/definitions/97.html) _(Severity: Very High)_
- [CAPEC-459 — Creating a Rogue Certification Authority Certificate](https://capec.mitre.org/data/definitions/459.html) _(Severity: Very High)_
- [CAPEC-473 — Signature Spoof](https://capec.mitre.org/data/definitions/473.html)
- [CAPEC-475 — Signature Spoofing by Improper Validation](https://capec.mitre.org/data/definitions/475.html) _(Severity: High)_
- [CAPEC-608 — Cryptanalysis of Cellular Encryption](https://capec.mitre.org/data/definitions/608.html) _(Severity: High)_
- [CAPEC-614 — Rooting SIM Cards](https://capec.mitre.org/data/definitions/614.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1036.001 — Masquerading: Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001/)
- [T1553.002 — Subvert Trust Controls: Code Signing](https://attack.mitre.org/techniques/T1553/002/)

## Referenzen

- <https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html>
- <https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4>
- <https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-56608) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_