The Galaxy FDS Android SDK, when run with its default configuration, disables TLS hostname verification by using ALLOW_ALL_HOSTNAME_VERIFIER. This weakness allows an attacker on the same network to present any TLS certificate, causing the SDK to accept it even if the hostname does not match. The result is a man‑in‑the‑middle that can intercept, alter, or eavesdrop on all communications with Xiaomi FDS cloud storage, potentially leaking authentication credentials, file data, and API responses. This is a classic example of improper authentication enabled by weak TLS configuration (CWE‑297).

Xiaomi Technology Co., Ltd. distributes the Galaxy FDS Android SDK. Versions up to and including 3.0.8, which are also in end‑of‑life status, configure Apache HttpClient with ALLOW_ALL_HOSTNAME_VERIFIER. All applications that integrate the SDK with its default HTTPS settings are thus affected.

The CVSS score of 9.1 classifies this vulnerability as critical, and the EPSS score of less than 1% indicates that the exploitability probability is low, though not impossible. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a network‑based MITM, where an adversary intercepts traffic between a client application and the FDS cloud endpoint. Exploitation requires the attacker to be able to serve a fraudulent TLS certificate; no additional system compromise is needed. The impact is remote, full‑scope compromise of data confidentiality and integrity for any application using the vulnerable SDK with default settings.