CVE-2017-16905

CVE-2017-16905 describes a critical vulnerability in the DuoLingo TinyCards Android application prior to version 1.0, where unencrypted HTTP communication allows remote attackers to spoof content. This flaw enables man-in-the-middle attacks, potentially leading to remote code execution on affected Google Android devices. With a CVSS score of 8.1 (HIGH), the vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, despite requiring high attack complexity. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.