CVE-2018-0691

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-15 · updated 2026-06-17
Weakness: CWE-295

Description

Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

Kddi + Message: before 1.0.6; before 1.1.23 — fixed in 1.0.6, 1.1.23
Ntt Tocomo + Message: before 1.1.23 — fixed in 1.1.23
Ntttocomo + Message: before 42.40.2800 — fixed in 42.40.2800
SoftBank + Message: before 10.1.7; before 1.1.23 — fixed in 1.1.23, 10.1.7

How to fix

Upgrade to a fixed version: Kddi + Message 1.0.6, 1.1.23; Ntt Tocomo + Message 1.1.23; Ntttocomo + Message 42.40.2800; SoftBank + Message 1.1.23, 10.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-0691 or the next vulnerability affects your stack