Lucene search
HistoryAug 02, 2024 - 11:16 a.m.
CVE-2024-40721
tcbservisign
windows version
changing information technology
unauthenticated
remote attackers
dll
arbitrary path
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
38.5%
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrary path.
Affected configurations
Node
changingtectcb_servisignRange<1.0.24.0318windows
| Vendor | Product | Version | CPE |
|---|---|---|---|
| changingtec | tcb_servisign | * | cpe:2.3:a:changingtec:tcb_servisign:*:*:*:*:*:windows:*:* |
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
38.5%
Related for NVD:CVE-2024-40721