Is there a public PoC exploit available for CVE-2024-43201?

Yes, a public proof-of-concept exploit is available for CVE-2024-43201. Prioritise patching immediately. EPSS: 0.4%.

Planet Fitness Workouts CVE-2024-43201

Q: What is the CVSS score of CVE-2024-43201?

CVE-2024-43201 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.4%.

HIGH

Improper Certificate Validation (CWE-295)

2024-09-23 9119a7d8-5eab-497f-8521-727c672e3725

Apple Information Disclosure Google Planet Fitness Workouts

8.7

CVSS 4.0 · Vendor: 9119a7d8-5eab-497f-8521-727c672e3725

Severity by source

Vendor (9119a7d8-5eab-497f-8521-727c672e3725) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber

Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725) · only source for this CVE.

CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Sep 23, 2024 - 20:15 cve.org

HIGH 8.7

DescriptionCVE.org

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).

AnalysisAI

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11). Affected products include: Planetfitness Planet Fitness Workouts. Version information: version 9.8.12.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.