Security readout for executives and security teams
Plain-English summary
This CVE concerns a 2017 iOS banking app version that reportedly failed to verify SSL server certificates. A person in the network path could impersonate the bank server and capture sensitive information, including login credentials. The sources do not provide a CVSS score, fixed version, or evidence of active exploitation.
Executive priority
Treat this as urgent if the affected app is still in use, because banking credentials may be exposed on hostile networks. If inventory confirms no use of version 3.0.1, priority drops to recordkeeping and user assurance.
Technical view
CVE-2017-9583 affects the Charlevoix State Bank iOS app 3.0.1, App Store identifier id1128963717. The issue is improper X.509 certificate validation for SSL connections, enabling man-in-the-middle server spoofing with a crafted certificate. Public metadata lists no CWE, CVSS vector, CPE, or vendor remediation details.
Likely exposure
Exposure is limited to users or managed devices still running Charlevoix State Bank for iOS version 3.0.1. Business risk is highest where banking credentials or account access depend on that mobile app.
Exploitation context
The cited sources describe a man-in-the-middle scenario requiring network positioning and user interaction with the vulnerable app. CISA KEV is false in the bundle, and no cited source states active exploitation.
Researcher notes
The record is sparse: no CVSS, CWE, CPE, fixed build, or vendor advisory is included in the supplied bundle. Analysis should stay scoped to Charlevoix State Bank for iOS 3.0.1 and the referenced 44-app advisory.
Mitigation direction
- Inventory iOS devices for Charlevoix State Bank app version 3.0.1.
- Require update or removal of the affected app where found.
- Check Charlevoix State Bank or app vendor guidance for fixed versions.
- Advise affected users to use verified current banking channels.
- Review suspicious account activity for users who used the affected app.
Validation and detection
- Confirm whether the app identifier id1128963717 exists on managed devices.
- Verify installed app versions through MDM or device inventory.
- Confirm current vendor-supported versions validate TLS certificates properly.
- Document whether affected users accessed banking services on untrusted networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9583 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.