Security readout for executives and security teams
Plain-English summary
A specific iOS mobile banking app version could trust a fake server certificate. If a customer used it over a network controlled or intercepted by an attacker, login credentials or other sensitive banking data could be exposed.
Executive priority
Treat this as high priority if the app or version remains in customer or employee use. The business issue is potential banking credential exposure, but urgency decreases if the vulnerable 2017 app is no longer distributed or functional.
Technical view
CVE-2017-9573 describes missing X.509 certificate validation in The North Adams State Bank (Ursa) nasb-mobile-banking iOS app 3.0.1. The failure allows a man-in-the-middle attacker to spoof SSL servers using a crafted certificate and intercept sensitive information.
Likely exposure
Exposure is limited to users of the named iOS app version 3.0.1. The source bundle does not confirm later versions, current App Store status, backend changes, or whether the app remains in use.
Exploitation context
The CVE describes man-in-the-middle exposure through crafted certificates. CISA KEV is false in the bundle, and no cited source confirms active exploitation. Practical risk depends on vulnerable app usage on interceptable networks.
Researcher notes
The public record is sparse: no CVSS vector, CWE, CPE, patch reference, or exploit confirmation is provided. Analysis should stay tied to the named app/version and certificate-validation failure unless vendor evidence expands scope.
Mitigation direction
- Check vendor guidance and App Store history for a fixed or retired app version.
- Remove or block version 3.0.1 from managed devices.
- Require users to update to a vendor-supported mobile banking app.
- Warn affected users to avoid the vulnerable app until vendor status is confirmed.
- Monitor potentially affected accounts for suspicious access or credential misuse.
Validation and detection
- Inventory MDM, EDR, or app-management data for the named iOS app and version 3.0.1.
- Confirm whether the app is still distributed, installed, or usable against production banking services.
- In controlled testing, verify current builds reject invalid or untrusted server certificates.
- Review vendor communications for remediation, retirement, or replacement-app guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9573 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.