vulnwire
7.5high

CVE-2016-6562

ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 38%
Public exploits
0
none known

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.02.9AV:A/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • ShoreTel Mobility Client iOS
  • ShoreTel Mobility Client Andoid

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

  • info-sec.ca /advisories/ShoreTel-Mobility.html · x_refsource_MISC, x_transferred
  • kb.cert.org /vuls/id/475907 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /bid/95224 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.