PT-2024-27501 · Microsoft+1 · Windows Os+1
Martin Schobert
+1
·
Published
2024-06-06
·
Updated
2024-07-03
·
CVE-2024-37364
CVSS v3.1
6.8
Medium
| Vector | AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ariane Allegro Scenario Player through 2024-03-05
Description
The issue allows physically proximate attackers to obtain sensitive information, such as hotel invoice content with personally identifiable information (PII), and potentially create unauthorized room keys, by entering a guest-search quote character and then accessing the underlying Windows OS. This affects the Ariane Duo kiosk mode. The vulnerability exposes the personal data of hotel guests, posing a significant risk to privacy. It is estimated that over 3,000 hotels are affected.
Recommendations
For Ariane Allegro Scenario Player through 2024-03-05, update the software to a version released after 2024-03-05 to prevent unauthorized access to sensitive information.
As a temporary workaround, consider restricting access to the kiosk mode until a patch is available.
Ensure the software is updated, monitor kiosks, and segment networks to minimize the risk of exploitation.
Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ariane Allegro Scenario Player
Windows Os