CVE-2017-9568

CVE-2017-9568 describes a critical vulnerability in the financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS, specifically affecting the myfpcu financial_plus_mobile_banking product. The flaw stems from the application's failure to properly validate X.509 certificates from SSL servers. This oversight allows remote man-in-the-middle attackers to spoof legitimate servers using crafted certificates, leading to the potential interception and compromise of sensitive user information. Rated with a CVSS score of 5.9 (MEDIUM), this vulnerability has a network-based attack vector and high attack complexity, meaning an attacker would need to overcome certain technical hurdles to successfully exploit it. Despite the medium severity, a successful exploit could result in a complete loss of confidentiality for sensitive data transmitted through the application. Currently, there is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has also garnered minimal community discussion and media coverage, suggesting a low level of public awareness or attention.