Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Openwave WAP gateway can be tricked with fake SSL certificates

CVE-2001-1569 · published 24 years ago
Summary

The Openwave WAP gateway does not check that the website name matches the SSL certificate it receives. This lets an attacker intercept traffic and present a forged certificate, making encrypted connections appear legitimate. Deploy a gateway version that validates the certificate’s domain name or add a filter that enforces proper certificate checking.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cmg openwave_wap_gateway All versions
cpe:2.3:a:cmg:openwave_wap_gateway:*:*:*:*:*:*:*:*
Original advisory text
Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man...
Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published31 Dec 2001
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2001-1569 · NVD
Track software like this
Free during beta