CVE-2017-5606
Status: ModifiedMedium (5.9)—
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Base score: 5.9
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.78%
- Percentile among all scored CVEs: 55
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-20, CWE-346
References
- http://openwall.com/lists/oss-security/2017/02/09/29
- http://www.securityfocus.com/bid/96186
- https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
- https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
- http://openwall.com/lists/oss-security/2017/02/09/29
- http://www.securityfocus.com/bid/96186
- https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
- https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Raw JSON (NVD)
Show
{
"id": "CVE-2017-5606",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-02-09T20:59:00.527",
"references": [
{
"url": "http://openwall.com/lists/oss-security/2017/02/09/29",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/96186",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2017/02/09/29",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/96186",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-346"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android)."
},
{
"lang": "es",
"value": "Una implementación incorrecta de \"XEP-0280: Message Carbons\" en múltiples clientes XMPP permite a un atacante remoto personificar cualquier usuario, incluidos los contactos, en la pantalla de la aplicación vulnerable. Esto permite varios tipos de ataques de ingeniería social. Esta CVE es para Xabber (sólo si está habilitado manualmente: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android)."
}
],
"lastModified": "2026-06-17T01:20:49.893",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xabber:xabber:*:*:*:*:-:android:*:*",
"vulnerable": true,
"matchCriteriaId": "86BE64EB-B76D-4A2A-92A1-D90F161A3008",
"versionEndIncluding": "1.0.30"
},
{
"criteria": "cpe:2.3:a:xabber:xabber:*:*:*:*:vip:android:*:*",
"vulnerable": true,
"matchCriteriaId": "48B0C95E-46D5-4E3C-8FFD-C102D81B495C",
"versionEndIncluding": "1.0.30"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}