PT-2024-34867 · Secusuite · Secusuite

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-51720

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SecuSUITE versions 5.0.420 and earlier

Description The issue is related to an insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server. This could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number. Additionally, the vulnerability is associated with a lack of authentication attempt limits, which may enable a remote attacker to bypass security restrictions and perform a brute force attack.

Recommendations For SecuSUITE versions 5.0.420 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-334

Related Identifiers

BDU:2025-01174

CVE-2024-51720

Affected Products

Secusuite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-51720 · Security Note
• https://bdu.fstec.ru/vul/2025-01174 · Security Note
• https://twitter.com/CVEnew/status/1856401864394248273 · Twitter Post
• https://support.blackberry.com/pkb/s/article/140220 · Note
• https://t.me/cvedetector/10679 · Telegram Post