PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5606 Xabber CVE debrief

CVE-2017-5606 is a medium-severity XMPP client flaw affecting Xabber Android builds listed by NVD as vulnerable when Message Carbons is manually enabled. The issue can let a remote attacker make the app display messages as if they came from another user, including contacts, which creates a social-engineering risk rather than direct code execution or data loss.

Vendor
Xabber
Product
Unknown
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Organizations and individuals using Xabber on Android, especially deployments where XEP-0280 Message Carbons was manually enabled. Messaging support teams and mobile app administrators should also care because the flaw can mislead users through impersonated message displays.

Technical summary

NVD describes an incorrect implementation of XEP-0280 Message Carbons in multiple XMPP clients. For Xabber Android, the vulnerable scope includes versions up to 1.0.30 and 1.0.30 VIP, with the issue noted as applying only if Message Carbons is manually enabled. The attack is network-based and requires no privileges or user interaction, but the CVSS vector shows high attack complexity and integrity impact only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). The practical effect is display impersonation in the client UI, which can be used for social engineering.

Defensive priority

Medium. The flaw is remotely reachable and can undermine trust in message authenticity, but NVD rates it as high-complexity with integrity-only impact and no availability or confidentiality impact.

Recommended defensive actions

  • Review whether XEP-0280 Message Carbons is enabled in Xabber Android deployments; disable it if it is not required.
  • Treat unexpected sender identity changes in chat clients as suspicious and verify sensitive requests through an independent channel.
  • Restrict reliance on client-side display names or message origin indicators for security decisions.
  • Check vendor and NVD guidance for a fixed Xabber release before continuing use of affected builds.
  • Monitor user reports for spoofed-message behavior and document any environments still running affected versions.

Evidence notes

This debrief is based on the supplied NVD record and linked references only. The NVD metadata lists affected Xabber Android CPEs and the CVSS v3.1 vector. The CVE description states that incorrect XEP-0280 Message Carbons handling can allow remote impersonation in the application's display and specifically notes Xabber Android as affected only when Message Carbons is manually enabled. No KEV entry is listed in the provided enrichment data.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5606 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5606

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5606 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5606

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.