Vulnerability · Published Dec 31, 2024 · Assigned by twcert

CVE-2024-12839Changing Information Technology CGFIDO - Authentication Bypass

High 8.8

In plain English

A high-severity security flaw in CGFIDO from Changing Information Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

Affected products (as reported)

Vendor	Product	Versions
Changing Information Technology	CGFIDO	0 – before 1.2.1

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html third-party-advisory