CVE-2025-71063

High

Published: 12 January 2026

Published

12 January 2026

Modified

05 February 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

EPSS Score 0.0002 3.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-71063 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Mrvladus Errands. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 3.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Adversary-in-the-Middle (T1557). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-17 Public Key Infrastructure Certificates good match

prevent

Directly requires validation and management of PKI certificates, preventing MITM attacks due to improper TLS certificate verification in Errands CalDAV connections.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation by patching Errands to version 46.2.10, which fixes the TLS certificate verification failure.

SC-8 Transmission Confidentiality and Integrity good match

prevent

Enforces cryptographic protection of transmission confidentiality and integrity, requiring proper TLS implementation with certificate validation for CalDAV sync traffic.

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Why these techniques?

Improper TLS certificate validation (CWE-295) directly enables active man-in-the-middle interception/modification of CalDAV traffic on an adjacent network.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.

Deeper analysisAI

CVE-2025-71063 affects the Errands application in versions prior to 46.2.10, where TLS certificates are not verified during connections to CalDAV servers. This flaw, classified under CWE-295 (Improper Certificate Validation), carries a CVSS v3.1 base score of 8.2 (High) with the vector AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. Published on 2026-01-12, it enables potential interception of sensitive synchronization data due to missing certificate checks.

Exploitation requires an adjacent network position (AV:A) and high attack complexity (AC:H), with no privileges (PR:N) or user interaction (UI:N) needed. Attackers can achieve scope change (S:C), resulting in high confidentiality and integrity impacts (C:H/I:H) alongside low availability impact (A:L). This allows man-in-the-middle interception or modification of CalDAV traffic, compromising task data synced between the app and servers.

Advisories and patches recommend upgrading to Errands 46.2.10, which addresses the issue via commit 04e567b432083fc798ea2249363ea6c83ff01099. Key references include the Debian bug report (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123738), GitHub issue #401 (https://github.com/mrvladus/Errands/issues/401), version comparison (https://github.com/mrvladus/Errands/compare/46.2.9...46.2.10), and the release page (https://github.com/mrvladus/Errands/releases/tag/46.2.10).