CVE-2025-14812

HIGH

ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.

CVSS 3.17.5
EPSS0.3%
Percentile18th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-1021: CWE-1021
Related Attack Patterns (CAPEC)
CAPEC-181 Flash File Overlay
via CWE-1021
CAPEC-222 iFrame Overlay
via CWE-1021
CAPEC-587 Cross Frame Scripting (XFS)
via CWE-1021
CAPEC-654 Credential Prompt Impersonation
via CWE-1021
CAPEC-103 Clickjacking
via CWE-1021
Show all 7

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

ArcSearch for iOS versions prior to 1.45.2 is vulnerable to a spoofing attack where the address bar can display a different domain than the content being shown, potentially deceiving users.

BSID: BS-2025-GLOBAL-032822-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-14812?
ArcSearch for iOS versions prior to 1.45.2 is vulnerable to a spoofing attack where the address bar can display a different domain than the content being shown, potentially deceiving users.
What is the CVSS score for CVE-2025-14812?
CVE-2025-14812 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS: 0.3%.
Is CVE-2025-14812 actively exploited?
No confirmed active exploitation of CVE-2025-14812 as of 2026-05-30.
How do I remediate CVE-2025-14812?
Priority: HIGH.
Vulnerability Details
CVE IDCVE-2025-14812
BSIDBS-2025-GLOBAL-032822-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published2025-12-19
Last Modified2026-04-15
ICS Relevance0%
Weakness (CWE)
CWE-1021
SourceNVD
Official Description

ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from an iframe-triggered URI-scheme navigation, which can manipulate the address bar to show a different domain than the actual content being rendered.

Exploitation Likelihood: MEDIUM

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 300 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash22ed9970eb4b5f816c31c8aec888545ad951eab6b7c5c8f9f9d0d12c36b6e819e92c26b85e10eb941781f990e34a405db69a4258cfa00553d51931ccf316a85b

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →