PT-2022-21721 · De.Fac2 · De.Fac2

Sergei Volokitin · Published 2022-08-24 · Updated 2022-08-29 · CVE-2022-33172

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions de.fac2 version 1.34

Description The issue allows bypassing the User Presence protection mechanism when malware is present on the victim's PC. This occurs due to a flaw in de.fac2 version 1.34, enabling potential exploitation.

Recommendations For de.fac2 version 1.34, consider disabling the User Presence protection mechanism temporarily until a patch is available to prevent bypassing. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2022-33172

Affected Products

De.Fac2

References · 5

• https://github.com/BSI-Bund/de.fac2/commit/d3c93c620850183d83ba9a0f5944d44a2ee30250 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-33172 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33172 · Vendor Advisory
• https://github.com/BSI-Bund/de.fac2 · Note
• https://t.me/cibsecurity/48639 · Telegram Post