Published:2025/11/17  Last Updated:2025/11/17

JVN#54005037
"デジラアプリ" App for iOS vulnerable to improper server certificate verification

Overview

"デジラアプリ" App for iOS provided by KDDI CORPORATION is vulnerable to improper server certificate verification.

Products Affected

  • "デジラアプリ" App for iOS versions prior to ver.80.10.00

Description

"デジラアプリ" App for iOS provided by KDDI CORPORATION contains the following vulnerability.

  • Improper server certificate verification (CWE-295)
    • CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 2.3
    • CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Base Score 4.8
    • CVE-2025-60022

Impact

A man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication.

Solution

Update the application
Update the application to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
KDDI CORPORATION Vulnerable 2025/11/17

References

JPCERT/CC Addendum

This analysis assumes a man-in-the-middle attack being conducted by an attacker that places a malicious wireless LAN access point.

Vulnerability Analysis by JPCERT/CC

Credit

Tsuyoshi Ogawa of SIE Co.,Ltd reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-60022
JVN iPedia JVNDB-2025-000097