PT-2024-26025 · Unknown · Kioware For Windows

Published 2024-05-09 · Updated 2025-02-12 · CVE-2024-3461

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions KioWare for Windows versions all through 8.35

Description The issue allows for brute forcing the PIN number that protects the application from being closed, due to the lack of mechanisms preventing excessive guessing of the number.

Recommendations For versions all through 8.35, consider implementing a mechanism to limit the number of PIN guesses to prevent brute force attacks, such as temporarily locking out the application after a certain number of incorrect attempts. As a temporary workaround, consider restricting access to the PIN-protected feature until a more robust security mechanism is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-3461

Affected Products

Kioware For Windows

References · 6

• https://osv.dev/vulnerability/CVE-2024-3461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3461 · Security Note
• https://cert.pl/en/posts/2024/04/CVE-2024-3459 · Note
• https://cert.pl/posts/2024/04/CVE-2024-3459 · Note
• https://kioware.com · Note
• https://t.me/cvenotify/111065 · Telegram Post