vulnwire
5.9med

CVE-2016-7805

The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certifica…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 51%
Public exploits
0
none known

The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Exploit prediction (EPSS)

0.64% probability of exploitation in the next 30 days, higher than 51% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Nihon Unisys, Ltd. mobiGate App for Android
  • Nihon Unisys, Ltd. mobiGate App for iOS

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

  • securityfocus.com /bid/94085 · vdb-entry, x_refsource_BID, x_transferred
  • jvn.jp /en/jp/JVN27260483/index.html · third-party-advisory, x_refsource_JVN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.