PT-2024-17758 · Changing Information Technology · Cgfido

周詳 · Published 2024-12-31 · Updated 2025-01-05 · CVE-2024-12839

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CGFIDO (affected versions not specified)

Description The login mechanism via device authentication of CGFIDO from Changing Information Technology has an authentication bypass issue. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2024-12839

Affected Products

Cgfido

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-12839 · Security Note
• https://twitter.com/CVEnew/status/1873926463331639484 · Twitter Post
• https://t.me/cvedetector/13968 · Telegram Post
• https://twcert.org.tw/en/cp-139-8335-e4a3f-2.html · Note
• https://twitter.com/VulmonFeeds/status/1873922446622867689 · Twitter Post
• https://twitter.com/CveFindCom/status/1873912732816130085 · Twitter Post
• https://t.me/latest_high_impact_cve/1732 · Telegram Post
• https://twcert.org.tw/tw/cp-132-8334-8b836-1.html · Note
• https://twitter.com/cracbot/status/1875784340766126185 · Twitter Post