CVE-2024-12839CWE-294

Changing Information Technology CGFIDO - Authentication Bypass

High · published December 31, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00721 · 53.4th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2024-12-31T01:32Z
EPSS history
Timeline
  • 31 DEC 01:32Z
    Changing Information Technology CGFIDO - Authentication Bypass
    cvelistv5