PT-2025-30572 · Microsoft+1 · Windows+2

Published 2025-07-23 · Updated 2025-07-23 · CVE-2024-12310

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Imprivata Enterprise Access Management versions 5.3 through 24.2

Description A flaw in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen on shared kiosk workstations, potentially granting unauthorized access to the underlying Windows system via the autologon account. This occurs due to insufficient handling of keyboard shortcuts.

Recommendations Update Imprivata Enterprise Access Management to a version later than 24.2.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-12310

Affected Products

Imprivata Enterprise Access Management

Imprivata Onesign

Windows

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-12310 · Security Note
• https://redguard.ch/blog/2025/07/23/cve-2024-12310-imprivata-bypass-of-login-screen · Note
• https://twitter.com/CVEnew/status/1947998284255014966 · Twitter Post
• https://t.me/cveNotify/129965 · Telegram Post