CVE-2026-121147High· 8.5▾ TwilightThis vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.09%
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
ira_2.0 versions 26.7.3 and belowira.ev versions 26.7.2 and belowUpgrade to latest versions:
Tata Motors iRA 2.0 to version 26.8.2
Tata Motors iRA.ev to version 26.9.1
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121144High· 8.8Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
CVE-2026-121146Medium· 6.8Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
CVE-2026-121145High· 7.1Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
CVE-2025-14022High· 7.7LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate
CVE-2018-0227High· 7.5A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to establish an SSL VPN…