CVE-2014-5960

CVE-2014-5960 describes a critical vulnerability in the BundesArztsuche (de.kbv.bas) Android application version 1.0.1, specifically affecting the kbv federal_doctors product. The application fails to properly validate X.509 certificates, making it susceptible to man-in-the-middle (MitM) attacks. An attacker could exploit this by spoofing legitimate servers with a crafted certificate, thereby intercepting and potentially compromising sensitive user information. This vulnerability carries a CVSS score of 5.4, indicating a medium severity. The attack requires adjacent network access (AV:A) and moderate attack complexity (AC:M), but no authentication is needed (Au:N). Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). Despite its potential impact, there is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.