CVE-2016-6562 json
ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections
published 2018-07-13 8 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7483
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 2.9 | AV:A/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- ShoreTel Mobility Client iOS
- ShoreTel Mobility Client Andoid
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
info-sec.ca
/advisories/ShoreTel-Mobility.html
third-party-advisory
-
kb.cert.org
/vuls/id/475907
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/95224
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2016-6562
- NVD CVE-2016-6562
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.