CVE-2025-8393
BaseFortify
Publication date: 2025-08-08
Last updated on: 2025-08-08
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown | phone_application | 4.0 |
| unknown | phone_application | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in a phone application used to manage a connected device. The application accepts self-signed TLS certificates when establishing secure communication. Because self-signed certificates are not verified by a trusted authority, this can allow an attacker on an untrusted network to perform a man-in-the-middle attack, intercepting and capturing communications including user credentials and sensitive session tokens.
How can this vulnerability impact me? :
The vulnerability can lead to man-in-the-middle attacks on untrusted networks, allowing attackers to capture sensitive information such as user credentials and session tokens. This can result in unauthorized access to the connected device or user accounts, potentially compromising security and privacy.