What is CVE-2021-37786?

CVE-2021-37786 is a medium-severity vulnerability in Bag Covid Certificate, classified under Improper Handling of Exceptional Conditions. CVSS score: 4.6/10. Published 2021-09-27.

How severe is CVE-2021-37786?

Medium severity. CVSS v3 base score is 4.6 out of 10.

Vulnerability in Bag Covid Certificate

CVE-2021-37786

Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code.

Published 2021-09-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.002 (8.3th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Bag Covid Certificate

Weakness classification (CWE)

CWE-755 — Improper Handling of Exceptional Conditions

References

github.com/admin-ch/CovidCertificate-App-iOS/issues/146 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2021-37786?: CVE-2021-37786 is a medium-severity vulnerability in Bag Covid Certificate, classified under Improper Handling of Exceptional Conditions. CVSS score: 4.6/10. Published 2021-09-27.
How severe is CVE-2021-37786?: Medium severity. CVSS v3 base score is 4.6 out of 10.