CVE-2012-2993

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-18 · updated 2026-06-16
Weakness: CWE-295

Description

Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.

Affected products

Microsoft Windows Phone 7 Firmware: all versions

References

http://osvdb.org/85619
http://www.kb.cert.org/vuls/id/389795
http://www.securityfocus.com/bid/55569
http://www.securitytracker.com/id?1027541
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620
http://osvdb.org/85619
http://www.kb.cert.org/vuls/id/389795
http://www.securityfocus.com/bid/55569
http://www.securitytracker.com/id?1027541
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620

Get alerted when CVE-2012-2993 or the next vulnerability affects your stack