CVE-2025-14022 - Vulnerability Details - OpenCVE

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Apple	Ios
Linecorp	Line

Configuration 1 [-]

cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*

No data.

References

Link	Providers
https://hackerone.com/reports/2853445

History

Thu, 18 Dec 2025 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-295
CPEs		cpe:2.3:a:linecorp:line::::::iphone_os::*

Mon, 15 Dec 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 15 Dec 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Linecorp Linecorp line
Vendors & Products		Apple Apple ios Linecorp Linecorp line

Mon, 15 Dec 2025 07:00:00 +0000

Type	Values Removed	Values Added
Description		LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.
References		https://hackerone.com/reports/2853445
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: LY-Corporation

Published: 2025-12-15T06:43:47.276Z

Updated: 2025-12-15T18:45:37.194Z

Reserved: 2025-12-04T11:45:01.936Z

Link: CVE-2025-14022

Vulnrichment

Updated: 2025-12-15T18:45:32.295Z

NVD

Status : Analyzed

Published: 2025-12-15T07:15:50.980

Modified: 2025-12-18T01:59:10.313

Link: CVE-2025-14022

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14022", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2025-12-04T11:45:01.936Z", "datePublished": "2025-12-15T06:43:47.276Z", "dateUpdated": "2025-12-15T18:45:37.194Z"}, "containers": {"cna": {"affected": [{"vendor": "LINE Corporation", "product": "LINE client for iOS", "versions": [{"version": "15.3", "status": "affected", "versionType": "custom", "lessThan": "15.4"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "descriptions": [{"lang": "en", "value": "LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications."}], "references": [{"url": "https://hackerone.com/reports/2853445"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 7.7, "temporalSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedUserInteraction": "NONE", "modifiedScope": "UNCHANGED", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedAvailabilityImpact": "LOW", "environmentalScore": 7.7, "environmentalSeverity": "HIGH"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:43:47.276Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T18:37:27.672507Z", "id": "CVE-2025-14022", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:45:37.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T18:37:27.672507Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:45:32.295Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "modifiedScope": "UNCHANGED", "temporalScore": 7.7, "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "LOW", "environmentalScore": 7.7, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "LOW", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "LINE Corporation", "product": "LINE client for iOS", "versions": [{"status": "affected", "version": "15.3", "lessThan": "15.4", "versionType": "custom"}]}], "references": [{"url": "https://hackerone.com/reports/2853445"}], "descriptions": [{"lang": "en", "value": "LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:43:47.276Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14022", "state": "PUBLISHED", "dateUpdated": "2025-12-15T18:45:37.194Z", "dateReserved": "2025-12-04T11:45:01.936Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2025-12-15T06:43:47.276Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}