CVE-2014-7767

CVE-2014-7767 describes a critical vulnerability in the A+ (cn.xrzcm) Android application version 1.0.1, specifically impacting the "yunlai a" product. The flaw stems from the application's failure to properly validate X.509 certificates from SSL servers, making it susceptible to man-in-the-middle (MITM) attacks. An attacker could exploit this by spoofing a legitimate server with a crafted certificate, leading to the potential compromise of sensitive user information. This vulnerability carries a CVSS score of 5.4, indicating a medium severity. Exploitation requires adjacent network access (AV:A) and moderate attack complexity (AC:M), but does not require authentication (Au:N). A successful attack could result in partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community attention and media coverage, suggesting it is not widely discussed or targeted.