CVE-2021-37909

CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation

State: Published
Severity: 9.8 Critical
Published: Sep 15, 2021
Updated: Sep 17, 2024
Reserved: Aug 2, 2021

Description

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
TSSServiSignAdapterCHANGING Inc.	1.0.20.0316 and earlierAffected

References

https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.