Cisco Spark Mobile Application Man-in-the-Middle Vulnerability

A vulnerability in the Cisco Spark mobile application could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device.

The vulnerability is due to improper validation of the SSL certificate used to manage the device. An attacker could exploit this vulnerability by using the default SSL certificate to view sensitive information.

Cisco has confirmed the vulnerability; however, software updates are not available.

Although a successful exploit could be used by an attacker to view sensitive information on a targeted device, the attacker may use the information gathered to conduct further attacks against the device.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.