Security readout for executives and security teams
Plain-English summary
PCSB BANK Mobile for iOS version 3.0.4 reportedly failed to verify SSL server certificates. That means a person controlling a network path could impersonate the bank’s server and capture sensitive information. The sources do not show active exploitation or a confirmed patch.
Executive priority
Treat this as a targeted mobile banking exposure with credential-risk implications, not a broad infrastructure emergency. Prioritize confirming whether the affected app version is still used and whether vendor remediation is available.
Technical view
The issue is improper X.509 certificate validation in the PCSB BANK Mobile iOS app 3.0.4. In a man-in-the-middle position, an attacker could spoof SSL servers using a crafted certificate and obtain sensitive information. No CVSS, CWE, or fixed version is provided in the source bundle.
Likely exposure
Exposure appears limited to users or organizations relying on PCSB BANK Mobile for iOS version 3.0.4. The bundle does not confirm whether later versions are affected, whether the app remains available, or whether a vendor fix exists.
Exploitation context
No KEV listing or cited source in the bundle indicates active exploitation. The described attack requires a man-in-the-middle position, such as control of or access to the user’s network path, plus continued use of the vulnerable app.
Researcher notes
Evidence is sparse: the CVE description names the vulnerable app and behavior, but affected CPEs, CVSS, CWE, and fix details are absent. Avoid expanding scope beyond PCSB BANK Mobile iOS 3.0.4 without vendor or advisory confirmation.
Mitigation direction
- Identify any use of PCSB BANK Mobile for iOS version 3.0.4.
- Check PCSB Bank or app vendor guidance for fixed versions or retirement notices.
- Require users to update or stop using the affected app if exposure is confirmed.
- Advise users to avoid untrusted Wi-Fi for mobile banking until resolved.
Validation and detection
- Inventory managed iOS devices for the PCSB BANK Mobile app and version.
- Confirm whether version 3.0.4 is present in mobile device management records.
- Review vendor advisories or app release history for certificate-validation fixes.
- Document whether affected users handle sensitive banking credentials through the app.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9587 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.