Security readout for executives and security teams
Plain-English summary
PCB Mobile for iOS version 3.0.2 reportedly failed to verify SSL server certificates. For a banking app, that could let someone on a hostile network impersonate the service and capture sensitive information, including login data. The public record does not provide CVSS, a fixed version, or evidence of active exploitation.
Executive priority
Treat as high priority if the app was used for banking access, especially on unmanaged or public networks. The main decision is whether any vulnerable installations still exist and whether a vendor-supported update or retirement path is available.
Technical view
CVE-2017-9591 describes missing X.509 certificate verification in the Phelps County Bank "PCB Mobile" iOS app 3.0.2. The flaw enables server spoofing through a crafted certificate in a man-in-the-middle scenario. Public metadata is sparse: no CVSS, CWE, CPE, or named remediation is provided.
Likely exposure
Exposure appears limited to users or environments still using PCB Mobile for iOS version 3.0.2. The CVE affected-product fields are marked n/a, so inventory should rely on app name, bundle reference, and version evidence rather than CPE matching.
Exploitation context
The sources support a network man-in-the-middle risk, not confirmed active exploitation. CISA KEV is false for this CVE. Practical abuse would require an attacker to influence the user’s network path and present a spoofed certificate accepted by the vulnerable app.
Researcher notes
The record is old and sparse. The CVE description and advisory identify the vulnerable behavior, but public metadata does not name a patch, fixed build, CVSS score, CWE, or structured affected CPE. Avoid assuming broader product impact beyond the named iOS app version.
Mitigation direction
- Identify any use of PCB Mobile for iOS version 3.0.2.
- Check Phelps County Bank or app vendor guidance for fixed versions.
- Upgrade to a version that verifies server certificates, if available.
- Retire or block the vulnerable app version where updates are unavailable.
- Advise affected users to monitor banking activity for suspicious access.
Validation and detection
- Confirm whether the installed iOS app version is 3.0.2.
- Review mobile device inventory for the PCB Mobile app identifier.
- Verify vendor release notes for a certificate validation fix.
- In authorized testing, confirm invalid server certificates are rejected.
- Document whether the app remains supported or has been retired.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9591 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.