LINE for iOS CVE-2025-14022

Exploitation requires the attacker to hold a man-in-the-middle position on the same or an attacker-controlled network segment as the victim (AV:A) - e.g., a rogue or compromised Wi-Fi access point - and to intercept traffic handled by the integrated financial SDK whose certificate verification was disabled; the affected path is the portion of LINE iOS network traffic routed through that SDK on versions prior to 15.4. Limiting factors: the attacker cannot exploit this remotely over the internet (adjacent-network only), must actively relay/alter TLS sessions rather than passively observe (AC:H), and the flaw is fixed in LINE for iOS 15.4, so patched clients and non-adjacent attackers are not exposed. No authentication or user interaction is required once the MITM position is established.

This is a moderate-severity transport-security flaw (CVSS 6.8) whose real-world priority is tempered by several limiting signals that align rather than conflict. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) requires the attacker to be network-adjacent (AV:A) and to establish a man-in-the-middle position with the associated complexity (AC:H), while needing no authentication (PR:N) or user interaction (UI:N); successful exploitation yields high confidentiality and integrity impact (C:H/I:H) but no availability impact (A:N). The low EPSS score (0.16%, 5th percentile) is consistent with the AC:H / AV:A constraints - mass, automated exploitation is impractical because the attacker must already control or share the victim's local network path. The vulnerability is NOT in CISA KEV, and the sole reference is a HackerOne disclosure report (#2853445) rather than published weaponized exploit code, so there is no confirmed active exploitation and no clearly public exploit. Net assessment: this is a legitimate privacy/integrity concern for a very widely used consumer messaging app, but it is a targeted/opportunistic-network risk (e.g., hostile Wi-Fi) rather than a drop-everything internet-wide threat; prioritize patching for high-risk mobile user populations but do not treat it as an actively-exploited emergency. Note: NVD CVSS says adjacent-network, which matches the MITM nature of the description - no AV/description conflict here.

A network-adjacent attacker on a shared or attacker-controlled network (for example, a malicious or compromised public Wi-Fi hotspot) positions themselves as a man-in-the-middle for a LINE iOS user running a version prior to 15.4. Because the integrated financial SDK disabled server certificate verification for a significant portion of the app's network traffic, the attacker can present a fraudulent certificate and transparently intercept or modify the otherwise TLS-protected communications. No public exploit identified at time of analysis; the issue was reported via a HackerOne disclosure.