VULNERABILITY INTELLIGENCE

CVE-2016-6562

CVSS score7.5 HIGH

EPSS probability0.44%

CISA KEVNot currently listed

Published2018-07-13

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.

Weakness classification

CWE-295: Improper Certificate Validation

Primary references

cret@cert.org — Third Party Advisory
cret@cert.org — Third Party Advisory, US Government Resource
cret@cert.org — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry