CVE-2020-5526: The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 d

The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers

Status

Published

2020-01-31

Updated

2024-08-04

Assigning organization

jpcert

Description

The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fuji Xerox Co.,Ltd. AWMS Mobile App

for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8affected

References

http://onlinesupport.fujixerox.com/processDriverForm.do?ctry_code=SG&lang_code=en&d_lang=en&corp_pid=AWMS2&rts=null&model=ApeosWare+Management+Suite+2&type_id=7&oslist=Windows+10+64bit&lang_list=en ↗
http://jvn.jp/en/jp/JVN00014057/index.html ↗