CVE-2026-35207: CWE-295: Improper Certificate Validation in linuxdeepin dde-control-center
dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.
AI Analysis
Technical Summary
The dde-control-center's plugin-deepinid in linuxdeepin versions prior to 6.1.80 and 5.9.9 does not properly validate TLS certificates when retrieving user avatars from specified cloud services. This improper certificate validation (CWE-295) can be exploited by an attacker positioned to intercept network traffic (MITM) to substitute the avatar image. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with impacts on confidentiality and integrity but no availability impact. The vulnerability is addressed by updates to dde-control-center 6.1.80 and 5.9.9.
Potential Impact
An attacker capable of performing a man-in-the-middle attack can intercept and alter avatar images fetched by the vulnerable plugin, potentially misleading users or enabling identification of users by their avatars. The confidentiality and integrity of the avatar data are impacted, but there is no direct impact on system availability or broader system compromise indicated.
Mitigation Recommendations
The vulnerability is fixed in dde-control-center versions 6.1.80 and 5.9.9. Users and administrators should upgrade affected dde-control-center installations to at least these versions to remediate the issue. Patch status is not explicitly stated as 'patchAvailable' in the data, but the vendor has fixed the issue in these versions, so updating to these or later versions is the recommended mitigation.
CVE-2026-35207: CWE-295: Improper Certificate Validation in linuxdeepin dde-control-center
Description
dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dde-control-center's plugin-deepinid in linuxdeepin versions prior to 6.1.80 and 5.9.9 does not properly validate TLS certificates when retrieving user avatars from specified cloud services. This improper certificate validation (CWE-295) can be exploited by an attacker positioned to intercept network traffic (MITM) to substitute the avatar image. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with impacts on confidentiality and integrity but no availability impact. The vulnerability is addressed by updates to dde-control-center 6.1.80 and 5.9.9.
Potential Impact
An attacker capable of performing a man-in-the-middle attack can intercept and alter avatar images fetched by the vulnerable plugin, potentially misleading users or enabling identification of users by their avatars. The confidentiality and integrity of the avatar data are impacted, but there is no direct impact on system availability or broader system compromise indicated.
Mitigation Recommendations
The vulnerability is fixed in dde-control-center versions 6.1.80 and 5.9.9. Users and administrators should upgrade affected dde-control-center installations to at least these versions to remediate the issue. Patch status is not explicitly stated as 'patchAvailable' in the data, but the vendor has fixed the issue in these versions, so updating to these or later versions is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-01T18:48:58.937Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d7ee091cc7ad14da04a8c3
Added to database: 4/9/2026, 6:20:57 PM
Last enriched: 4/17/2026, 11:52:50 AM
Last updated: 5/25/2026, 12:20:31 PM
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.