CVE-2017-5634

The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to manipulate the print dialog.

Score

CVSS 3.0 6.6 Medium

Status

Modified - cve@mitre.org

Published

2017-02-09

Last modified

2024-08-05

Weaknesses

CWE-668

Affected products

• Norwegian Air Kiosk (Norwegian-air)

References

• http://www.securityfocus.com/bid/96230
• https://bugemot.com/bug/190
• https://www.youtube.com/watch?v=2j9gP5Qu2WA
• https://www.youtube.com/watch?v=WSQW0ipnXQg