{"id":"CVE-2026-121147","kind":"vulnerability","aliases":["CVE-2026-121147"],"related":[],"title":"iRA mobile apps: broken certificate pinning lets traffic be intercepted","description":"This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.","summary":"The iRA 2.0 and iRA.ev mobile apps do not correctly enforce SSL certificate pinning in their network security configuration. An attacker on the network path can intercept or modify traffic between the app and its backend services.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ira-mobile","mobile-apps","other"],"not_affected_if":["app-not-installed"],"how_to_check":"- Check whether iRA 2.0 or iRA.ev is installed on the device. The sources give no affected or fixed version numbers, so compare against the app store changelog once the vendor publishes one. Avoid using the app on untrusted Wi-Fi until an update is out.","fix":null,"status":"open","published_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:27:55+00:00","updated_at":"2026-11-04T13:28:57+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-04T13:27:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"iRA mobile apps: broken certificate pinning lets traffic be intercepted","impact":"medium","summary":"The iRA 2.0 and iRA.ev mobile apps do not correctly enforce SSL certificate pinning in their network security configuration. An attacker on the network path can intercept or modify traffic between the app and its backend services.","audience":"everyone","category":"other","nicknames":[],"who_cares":["ira-mobile","mobile-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"traffic to backend services intercepted and modified in transit","analyst_note":"Find affected app versions, the fixed release, and the vendor advisory for CVE-2026-121147 at the NVD link.","how_to_check":"- Confirm whether the installed iRA 2.0 or iRA.ev app is present on the device\n- unknown for specific version ranges: the sources do not say which builds are affected","plain_action":"If you use the iRA 2.0 or iRA.ev app, check the app store for an update; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["app-not-installed"],"who_is_affected":"Users of the iRA 2.0 and iRA.ev mobile apps whose traffic can be intercepted, such as on hostile or untrusted networks. The sources do not name affected version ranges or the backend services involved. Teams that do not use these apps can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4144,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected app versions, the fixed release, and the vendor advisory for CVE-2026-121147 at the NVD link.","search":"'-121147':13A,16A '-2026':12A,15A '2.0':25B,66C 'app':3A,22B,29B,55B 'applic':70C,108C 'attack':43B,91C 'backend':58B,111C 'broken':4A 'certif':5A,35B,77C,87C 'communic':105C 'configur':41B,83C 'control':89C 'correct':32B 'could':97C 'cve':11A,14A 'due':71C 'enforc':33B 'exist':62C 'exploit':98C 'implement':74C 'improp':73C 'ineffect':86C 'intercept':10A,49B,94C,102C 'ira':1A,18B,24B,65C 'ira-mobil':17B 'ira.ev':27B,68C 'let':7A 'mobil':2A,19B,21B,28B,69C 'mobile-app':20B 'modifi':51B,104C 'network':39B,46B,81C,95C 'path':47B 'pin':6A,36B,78C,88C 'posit':92C 'result':84C 'secur':40B,82C 'servic':59B,112C 'ssl':34B,76C 'traffic':8A,52B,96C 'vulner':61C,100C","nicknames":[],"mitigations":[],"who_affected":"Users of the iRA 2.0 and iRA.ev mobile apps. An attacker on the same network, such as public Wi-Fi, could intercept or modify traffic between the app and its backend because certificate pinning is ineffective. No affected version range or fixed release has been published in the sources found. Teams and people who do not use these apps can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you use the iRA 2.0 or iRA.ev app, check the app store for an update; the sources do not name a fixed version.","pkeys":[],"ptokens":[],"labels":["high","iramobile","mobileapps","other"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121147","severity":null,"published_at":"2026-11-04T13:17:27+00:00","modified_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121147:1668","url":null,"severity":null,"published_at":"2026-11-04T13:28:57+00:00","modified_at":"2026-11-04T13:28:57+00:00","first_seen_at":"2026-11-04T13:28:57+00:00","fetched_at":"2026-11-04T13:28:57+00:00","note":"No vendor advisory or CERT-In note found via search; NVD page fetched empty. Affected versions and fix unknown. Settle by finding the CERT-In CIVN note (reporter vdisclose@cert-in.org.in) or the app store changelog. Nothing verified. Tata Motors publishes iRA 2.0/iRA.ev per its own PDF, but the CVE text does not name a vendor."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}