Vulnerability · Published Dec 20, 2021 · Assigned by THA-PSIRT
CVE-2021-42138
High 7.2
In plain English
A high-severity security flaw in Safenet Authentication Service from Thales CPL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Thales CPL | Safenet Authentication Service | Windows Logon Agent – before 3.4.4 |
References
- https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955 x_refsource_MISC
- https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb&id=kb_article_view&sysparm_rank=2&sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955 x_refsource_MISC
- https://cpl.thalesgroup.com/support/security-updates x_refsource_MISC