Taipower Android App Fails to Check Server Certificates

Summary

The Taipower Android app does not properly check the identity of the server it connects to, making it possible for a malicious third party to intercept and alter communication between the app and the server. This could allow an attacker to read or change sensitive information. Users should be cautious when using this app and consider updating to a version that fixes this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
taipower	taipower_app	<= 3.4.4	–

Original title

Taipower APP for Andorid developed by Taipower has an Improper Certificate Validation vulnerability. When establishing an HTTPS connection with the server, the application fails to verify the serve...

Original description

Taipower APP for Andorid developed by Taipower has an Improper Certificate Validation vulnerability. When establishing an HTTPS connection with the server, the application fails to verify the server-side TLS/SSL certificate. This flaw allows an unauthenticated remote attackers to exploit the vulnerability to perform a Man-in-the-Middle (MITM) attack to read and tamper with network packets.

nvd CVSS3.1 6.5

nvd CVSS4.0 8.3

Vulnerability type

CWE-295 Improper Certificate Validation