Vulnerability · Published Aug 2, 2024 · Assigned by twcert
CVE-2024-40722CHANGING Information Technology TCBServiSign Windows Version - Stack-based Buffer Overflow
Medium 4.3
In plain English
A medium-severity stack buffer overflow in TCBServiSign Windows Version from CHANGING Information Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the TCBServiSign, temporarily disrupting its service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CHANGING Information Technology | TCBServiSign Windows Version | 0 – before 1.0.24.0318 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
References
- https://www.twcert.org.tw/tw/cp-132-7967-9efdf-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7973-e10c6-2.html third-party-advisory