Security readout for executives and security teams
Plain-English summary
Open ISES Tickets before 3.44.2 may trust forged TLS certificates during RouteMate mobile login. A network-positioned attacker could intercept or alter authentication traffic, potentially exposing API keys or session data. The weakness affects confidentiality and integrity but requires access to the network path.
Executive priority
Treat this as a high-priority upgrade for exposed or actively used RouteMate deployments. Accelerate remediation where authentication traffic crosses shared, externally managed, or otherwise untrusted networks. Investigate and rotate credentials if interception may have occurred.
Technical view
The RouteMate login code in rm/incs/mobile_login.inc.php disables CURLOPT_SSL_VERIFYPEER and does not configure CURLOPT_SSL_VERIFYHOST for outbound HTTPS requests. This creates CWE-295 improper certificate validation. The supplied CVSS 4.0 score is 8.2, reflecting potentially high confidentiality and integrity impact with high attack complexity.
Likely exposure
Exposure is limited to Open ISES Tickets versions before 3.44.2 using the RouteMate mobile login flow. Risk is greatest where an attacker can influence DNS, routing, proxies, Wi-Fi, or another segment between the Tickets server and its remote endpoint.
Exploitation context
The supplied record is not listed in CISA KEV, and the source bundle provides no evidence of active exploitation or a public exploit. Successful abuse requires a network-path position and a forged certificate accepted by the vulnerable server-side request.
Researcher notes
The vulnerable behavior is specifically identified in rm/incs/mobile_login.inc.php. The cited commit and 3.44.2 release are the supplied remediation evidence. The unusual affected-version metadata lists "0," but the narrative explicitly states versions before 3.44.2; validate local versions against vendor materials.
Mitigation direction
- Upgrade Open ISES Tickets to version 3.44.2 or later.
- Prioritize systems using the RouteMate mobile login flow.
- Protect outbound traffic and restrict untrusted access to relevant network paths.
- Review vendor release notes and patch details before deployment.
- Rotate exposed API keys or sessions if interception is suspected.
Validation and detection
- Inventory Open ISES Tickets deployments and record their exact versions.
- Confirm every deployment is running version 3.44.2 or later.
- Verify RouteMate login requests perform peer and hostname certificate validation.
- Review network and application logs for unexpected endpoints, certificates, or authentication anomalies.
- Test the mobile login flow after upgrading without bypassing TLS validation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48249 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N2.23.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.2HighVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openises/tickets/releases/tag/v3.44.2CVE reference, VulnCheck · release-notes
- https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbffCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-rm-incs-mobile-login-inc-phpCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.