CVE-2016-6562

Published: Jul 13, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.

Affected (2)

Products: Mitel: Shortel Mobility Client

1 product

Shortel Mobility Client

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mitel Shortel Mobility Client	Version 9.1.3.109
Mitel Shortel Mobility Client	Version 9.1.3.109

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (6)

https://www.info-sec.ca/advisories/ShoreTel-Mobility.html

Source: cret@cert.org

Third Party Advisory

https://www.kb.cert.org/vuls/id/475907

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

https://www.securityfocus.com/bid/95224

Source: cret@cert.org

Third Party AdvisoryVDB Entry

https://www.info-sec.ca/advisories/ShoreTel-Mobility.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.kb.cert.org/vuls/id/475907

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.securityfocus.com/bid/95224

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.