Description

The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it.

Related CPE's

a

changingtec

tcb_servisign

*

*

*

*

*

windows

Vulnerable

References

https://www.twcert.org.tw/en/cp-139-7970-e8ac5-2.html

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-7964-5b266-1.html

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-326

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.5 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-08-02T10:16:00.470

2 months ago

Last modified

2024-08-09T14:36:32.300

2 months ago