by Kastro
Paper/Archive/CVE-2021-37909

CVE-2021-37909

CHANGING Inc. TSSServiSignAdapter — CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.8.808 × 2016.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

Affected

ProductAffectedFixed inSource
TSSServiSignAdapterunspecified – 1.0.20.0316–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5093-76f04-1.html