Taipower APP for Android fails to verify the server’s TLS/SSL certificate when establishing an HTTPS connection. This Improper Certificate Validation flaw (CWE‑295) allows an unauthenticated remote attacker to intercept, read, or modify the data traffic between the mobile device and the Taipower server, compromising both confidentiality and integrity of the transmitted information.

The vulnerability affects Taipower’s mobile application for Android devices. Applications with the version prior to 3.4.5 are vulnerable; the vendor recommends updating to version 3.4.5 or later.

The CVSS score of 8.3 identifies a high severity vulnerability. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote, unauthenticated attacker capable of performing a Man‑in‑the‑Middle attack over an HTTPS session, potentially on the same network or via compromised servers.