CVE-2014-5994

CVE-2014-5994 describes a critical vulnerability in the ding ezetop. Top-up Any Phone (com.ezetop.world) Android application version 1.3.4. The application fails to properly validate X.509 certificates, making it susceptible to Man-in-the-Middle (MitM) attacks. An attacker on the same network can exploit this weakness to spoof SSL servers, intercepting and potentially compromising sensitive user information. This vulnerability has a CVSS score of 5.4, indicating a medium severity. Its attack vector is adjacent network (AV:A), requiring the attacker to be on the same local network as the victim, and attack complexity is medium (AC:M). The potential impact includes partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness and exploitation.