CVE-2002-2125: Microsoft Ie

Medium severity, CVSS 6.4. EPSS: 8.3% chance of exploitation in the next 30 days.

Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 6.0.2600 only; version 6.0.2800.1106 only

Published 2002-12-31. Last modified 2026-06-16.