Skip to content
CVE Tracker
Back

CVE-2016-6562

ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections

High7.5EPSS 0.44%
Published
Updated
Reserved
Assigned by
certcc

Description

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.

Scores

CVSS scores of CVE-2016-6562, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0High7.5CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.44% · top 62% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • ShoreTel · Mobility Client iOS

    • affected 9.1.3.109 – ≤ 9.1.3.109

  • ShoreTel · Mobility Client Andoid

    • affected 9.1.3.109 – ≤ 9.1.3.109

What to do

Solution: ShoreTel has released version 9.1.5.104 for all devices to address the vulnerability.

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .