Vulnerability in Apple Iphone OS
CVE-2017-2278
The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Vulnerability class: Improper Certificate Validation
EPSS: 0.006 (46.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apple Iphone_os
- Google Android
- Iid Rbb_speed_test
- Iid, Inc. Rbb Speed Test App For Android — versions version 2.0.3 and earlier
- Iid, Inc. Rbb Speed Test App For Ios — versions version 2.1.0 and earlier
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC, Broken Link)
- vultures@jpcert.or.jp (VDB Entry, Third Party Advisory, x_refsource_JVN, third-party-advisory)
Frequently asked questions
- What is CVE-2017-2278?
- CVE-2017-2278 is a medium-severity vulnerability in Apple Iphone OS, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2017-08-02.
- How severe is CVE-2017-2278?
- Medium severity. CVSS v3 base score is 5.9 out of 10.