CVE-2011-0228

CVE-2011-0228 is a critical vulnerability affecting Apple iOS before versions 4.2.10 and 4.3.5. It stems from a flaw in the Data Security component, which fails to properly validate the basicConstraints parameter in X.509 certificate chains. This oversight enables man-in-the-middle attackers to spoof SSL servers by using a non-CA certificate to sign certificates for arbitrary domains. With a CVSS score of 7.5, this vulnerability is considered highly severe, allowing unauthenticated attackers to compromise confidentiality, integrity, and availability over a network with low attack complexity. The EPSS score of 0.08007 indicates a relatively low likelihood of exploitation in the wild, despite its high CVSS. While no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available, and there is minimal community discussion or media coverage, the vulnerability's nature suggests a potential for significant impact if exploited. It is not listed in CISA's KEV catalog and is considered inactive on the Hot List.