CVE-2023-5554VulnerabilityPublished 12 Oct 2023Updated 9 Dec 2025

CVE-2023-5554: LINE client for iOS · na

Affects LINE client for iOSSource CVE Database V5

Not known to be exploited · CVSS 4.8 Medium.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

4.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Oct 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
SwiftURLline/line-client-ios`pkg:swift/line/line-client-ios`Other threats	Affected =13.12.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

1. Immediate update of the LINE client for iOS to version 13.16.0 or later, where the TLS certificate verification issue is resolved. 2. Enforce the use of trusted and secure network environments, such as VPNs or corporate networks with strong perimeter defenses, especially when accessing financial features within LINE. 3. Implement network monitoring and intrusion detection systems to identify anomalous TLS traffic or potential man-in-the-middle activities targeting LINE communications. 4. Educate users on the risks of using public or unsecured Wi-Fi networks for financial transactions and encourage the use of cellular data or VPNs. 5. Coordinate with LINE Corporation for timely patch deployment and verify the integrity of app updates through official channels. 6. For organizations with mobile device management (MDM), enforce app update policies and restrict installation of outdated app versions. 7. Conduct regular security assessments of mobile applications used for financial purposes to detect similar cryptographic or transmission flaws. 8. Review and audit logs and financial transaction records for signs of tampering or unauthorized access that could be related to this vulnerability.

Description

CVE-2023-5554 is a medium-severity vulnerability affecting the LINE client for iOS versions prior to 13.16.0, specifically version 13.12.0. The flaw involves a lack of TLS certificate verification during log transmission in a financial module, which could allow an attacker to intercept or manipulate sensitive data. Exploitation requires network access but no user interaction or privileges. While no known exploits are currently in the wild, the vulnerability impacts confidentiality and integrity of transmitted data. European organizations using LINE for financial communications on iOS devices should prioritize updating to patched versions. Mitigations include updating the app, using secure network environments, and monitoring for suspicious network activity.

Impact

For European organizations, the vulnerability poses a risk to the confidentiality and integrity of financial data transmitted via the LINE iOS client. Organizations relying on LINE for financial communications or transactions on iOS devices could face data interception or manipulation by attackers with network access, potentially leading to financial fraud, data leakage, or compliance violations under GDPR. The impact is heightened in sectors with stringent data protection requirements, such as banking, fintech, and regulated industries. Although the vulnerability does not affect availability, the compromise of log data integrity could hinder forensic investigations and incident response. The medium severity rating suggests a moderate risk, but the financial context elevates the importance of timely remediation. Additionally, the lack of user interaction and privileges required for exploitation means that attackers can potentially exploit this vulnerability silently if they can position themselves on the network path. This is particularly concerning in environments with frequent use of public or unsecured Wi-Fi networks.

References

hackerone.com/reports/2106827 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Dec 2025, 08:15 UTC

Technical details

References

Community reviews

Related threats