Improper certificate validation in ShoreTel Mobility Client iOS
Priority LOW 33CWE-295Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.
Why it matters now
EPSS 0.00437 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ShoreTel | Mobility Client iOS | 9.1.3.109 – 9.1.3.109 | — | No fix listed | CNA |
| ShoreTel | Mobility Client Andoid | 9.1.3.109 – 9.1.3.109 | — | No fix listed | CNA |
- Mobility Client iOS VendorShoreTel Affected 9.1.3.109 – 9.1.3.109 Fixed in — No fix listed CNA
- Mobility Client Andoid VendorShoreTel Affected 9.1.3.109 – 9.1.3.109 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6562
- 2026-10-03 Alias added: GHSA-gp9v-8hxx-pqxm
References
Sources
- CVE-2016-6562 · CVE Program
- CVE-2016-6562 · NVD
- FIRST EPSS
- GHSA-gp9v-8hxx-pqxm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences