CVE-2014-6611

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-25 · updated 2026-06-17
Weakness: CWE-20

Description

The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.

Affected products

Blackberry Os: 10.3.0, 10.2.1, 10.2.0
Blackberry World: through 5.1.0.52; through 5.0.0.262; through 5.0.0.261

References

http://secunia.com/advisories/61013
http://www.blackberry.com/btsc/kb36360
http://secunia.com/advisories/61013
http://www.blackberry.com/btsc/kb36360

Get alerted when CVE-2014-6611 or the next vulnerability affects your stack