CVE-2017-14582

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101091Third Party Advisory, VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/Third Party Advisory
http://www.securityfocus.com/bid/101091Third Party Advisory, VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/Third Party Advisory

Timeline

Published: Sep 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-145836.5NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a De CVE-2017-145857.2A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was intr CVE-2017-145869.8The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop c CVE-2017-145875.4The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary CVE-2017-145886.1Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-145899.6It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted a CVE-2017-14594.2IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resou CVE-2017-145909.1Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to cr CVE-2017-145919.0Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria CVE-2017-145928.8Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission t CVE-2017-145938.8Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission CVE-2017-145946.1The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attacke