9.2

CVE-2025-7395

Domain Name Validation Bypass with Apple Native Certificate Validation

A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL
 client failing to properly verify the server certificate's domain name,
 allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerwolfSSL
≫
Produkt wolfSSL
Default Statusunaffected
Version <= 5.8.0
Version 5.6.4
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.389
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
facts@wolfssl.com 9.2 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:Red
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.