PT-2021-23241 · Omikron · Omikron Multicash Desktop

Manuel Stotz + 1 · Published 2021-10-05 · Updated 2021-10-09 · CVE-2021-41286

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omikron MultiCash Desktop version 4.00.008.SP5

Description The issue arises from a client-side authentication mechanism. When a user logs in, the password validity is checked locally. All database backend communication uses the same technical account. An attacker can exploit this by attaching a debugger to the process or creating a patch that manipulates the login function to always return a success value, allowing login with any account, including the administrative account.

Recommendations For Omikron MultiCash Desktop version 4.00.008.SP5, consider disabling the login function until a patch is available to prevent exploitation. Restrict access to the administrative account to minimize risk. Avoid using the application until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-41286

Affected Products

Omikron Multicash Desktop

References · 4

• https://osv.dev/vulnerability/CVE-2021-41286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41286 · Security Note
• https://t.me/cibsecurity/29994 · Telegram Post
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-047.txt · Note