CVE-2026-121147: High severity vulnerability
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the iRA 2.0 and iRA.ev mobile applications are exposed when an attacker can position themselves to intercept the application's network traffic.
What does an attacker need to exploit it?
The attacker needs to be in a network position that allows interception of traffic between the mobile application and its backend services. No privileges are required, but user interaction is required according to the supplied severity vector.
What could an attacker do after successful exploitation?
An attacker could intercept or modify communications between the affected application and its backend services.