Overview
The Acer Portal app for Android allows customers to connect to the Acer Cloud. The Acer Portal app, from version 3.9.3.2003 to 3.9.3.2006, does not properly validate SSL certificates when connecting to the Acer Cloud.
Description
CVE-2016-5648 - CWE-295: Improper Certificate Validation The Acer Portal app for Android, from version 3.9.3.2003 to 3.9.3.2006, does not properly validate SSL certificates when connecting to the Acer Cloud. A remote unauthenticated attacker capable of conducting a man-in-the-middle attack may be able to impersonate the Acer Cloud and obtain a victim's account credentials or other cloud information. |
Impact
A remote unauthenticated attacker capable of conducting a man-in-the-middle attack may be able to impersonate the Acer Cloud and obtain a victim's account credentials or other cloud information. |
Solution
Apply an update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| Temporal | 4.5 | E:POC/RL:OF/RC:C |
| Environmental | 3.4 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to David Coomber for reporting this vulnerability.
This document was written by Garret Wassermann.
Other Information
| CVE IDs: | CVE-2016-5648 |
| Date Public: | 2016-07-05 |
| Date First Published: | 2016-07-05 |
| Date Last Updated: | 2016-07-05 15:58 UTC |
| Document Revision: | 9 |