CVE-2017-15999: Nq Contacts Backup & Restore

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.

Affected products

• Nq Contacts Backup & Restore: version 1.1 only

Published 2017-10-29. Last modified 2026-06-17.