CVE-2024-40720
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute arbitrary commands.
- Score
- CVSS 3.1 8.8 High
- Status
- Analyzed - twcert@cert.org.tw
- Published
- 2024-08-02
- Last modified
- 2024-08-02
- Weaknesses
- CWE-20
Affected products
- Tcbservisign Windows Version (Changing Information Technology)
- Tcbservisign (Changinginformationtechnology)
- Tcb Servisign (Changingtec)
References
- https://www.twcert.org.tw/en/cp-139-7971-d9584-2.html
- https://www.twcert.org.tw/tw/cp-132-7965-8285d-1.html
