JVN#89109713
WTW-EAGLE App vulnerable to improper server certificate validation
Overview
WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. is vulnerable to improper server certificate validation.
Products Affected
- WTW-EAGLE App for iOS versions prior to 4.4.1
- WTW-EAGLE App for Android versions prior to 4.4.0.10
Description
WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. contains the following vulnerability.
- Improper server certificate validation (CWE-295)
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Base Score 4.8
- CVE-2025-58781
Impact
A man-in-the-middle attacker may be able to monitor encrypted traffic.
Solution
Update the application
Update the application to the latest version according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| Wireless Tsukamoto Co., Ltd. | WTW-EAGLE App for iOS (Text in Japanese) |
| WTW-EAGLE App for Android (Text in Japanese) |
References
JPCERT/CC Addendum
CVSS v3 and v4 scores for CVE-2025-58781 are based on the scenario where an attacker performs a man-in-the-middle attack using a malicious wireless LAN access point.
Vulnerability Analysis by JPCERT/CC
Credit
Shogo Iyota of GMO Cybersecurity by Ierae reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2025-58781 |
| JVN iPedia |
JVNDB-2025-000048 |