The vulnerability involves improper certificate validation (CWE-295) in the plugin-deepinid of dde-control-center, which is part of the Deepin Desktop Environment. Before version 6.1.80, the plugin does not verify TLS certificates when retrieving user avatars, exposing the process to man-in-the-middle attacks. This can lead to an attacker substituting the avatar image with a malicious or misleading image and potentially identifying the user. The vulnerability affects dde-control-center versions >= 6.1.35 and < 6.1.80, and >= 5.5.3 and < 5.9.9. The issue is resolved in versions 6.1.80 and 5.9.9.

The vulnerability allows an attacker positioned in a man-in-the-middle role to intercept and modify avatar images fetched by the vulnerable plugin. This can result in misleading or malicious images being displayed and may enable the attacker to identify the user by the avatar. There is no indication of impact on system availability or integrity beyond the avatar substitution and user identification risk.

A fix is available in dde-control-center versions 6.1.80 and 5.9.9. Users and administrators should upgrade to these or later versions to remediate the vulnerability. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed beyond the stated fixed versions, so users should verify with official Deepin sources for the latest remediation guidance.