CVE-2025-14022

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://hackerone.com/reports/2853445	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El cliente LINE para iOS anterior a 15.4 permite ataques man-in-the-middle debido a una validación inadecuada del certificado SSL/TLS en un SDK financiero integrado. El SDK interfirió con el procesamiento de red de la aplicación, lo que provocó que la verificación del certificado del servidor se deshabilitara para una parte significativa del tráfico de red, lo que podría permitir a un atacante adyacente a la red interceptar o modificar comunicaciones cifradas.

Information

Published : 2025-12-15 07:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-14022

Mitre link : CVE-2025-14022

CVE.ORG link : CVE-2025-14022

JSON object : View

Products Affected

linecorp

line

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-14022", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14022", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T18:37:27.672507Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "dl_cve@linecorp.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "dl_cve@linecorp.com", "affectedData": [{"vendor": "LINE Corporation", "product": "LINE client for iOS", "versions": [{"status": "affected", "version": "15.3", "lessThan": "15.4", "versionType": "custom"}]}]}], "published": "2025-12-15T07:15:50.980", "references": [{"url": "https://hackerone.com/reports/2853445", "tags": ["Permissions Required", "Third Party Advisory"], "source": "dl_cve@linecorp.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications."}, {"lang": "es", "value": "El cliente LINE para iOS anterior a 15.4 permite ataques man-in-the-middle debido a una validaci\u00f3n inadecuada del certificado SSL/TLS en un SDK financiero integrado. El SDK interfiri\u00f3 con el procesamiento de red de la aplicaci\u00f3n, lo que provoc\u00f3 que la verificaci\u00f3n del certificado del servidor se deshabilitara para una parte significativa del tr\u00e1fico de red, lo que podr\u00eda permitir a un atacante adyacente a la red interceptar o modificar comunicaciones cifradas."}], "lastModified": "2026-10-07T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "9676D59E-4753-4A11-8AC4-289E856F3D16", "versionEndExcluding": "15.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "dl_cve@linecorp.com"}