CVE-2026-121147
Received Received - Intake

Improper SSL Certificate Pinning in iRA Mobile Apps

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121147
EUVD
EUVD-2026-116908

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Tata Motors Tata Motors iRA 2.0 versions 26.7.3 and below
Tata Motors Tata Motors iRA.ev versions 26.7.2 and below

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the iRA 2.0 and iRA.ev mobile apps due to improper SSL certificate pinning. This means the apps fail to properly verify server certificates, allowing attackers to intercept or alter communications between the app and backend services.

Detection Guidance

Detecting improper SSL certificate pinning requires network analysis tools. Use tools like Wireshark or mitmproxy to intercept and inspect traffic from the iRA 2.0 or iRA.ev apps. Check if the apps accept self-signed or unexpected certificates, which indicates weak pinning. Alternatively, use Frida or objection to dynamically analyze the apps for certificate pinning bypasses.

Impact Analysis

An attacker could eavesdrop on sensitive data like login credentials or personal information. They might also modify data in transit, leading to unauthorized actions or data tampering.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Immediately update the iRA 2.0 and iRA.ev applications to the latest patched versions if available. Disable network traffic interception tools if used for legitimate purposes. Ensure all backend services enforce strict certificate validation. Monitor network traffic for suspicious activity and restrict access to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...