Description
The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it.
References
https://www.twcert.org.tw/en/cp-139-7970-e8ac5-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7964-5b266-1.html
Third Party Advisory
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 · Medium
CVSS V3.1
CVSS V3.0
CVSS V2.0
Information
Source identifier
Vulnerability status
Analyzed
Published
2024-08-02T10:16:00.470
2 months agoLast modified
2024-08-09T14:36:32.300
2 months ago