CVE-2024-12839

HIGH

CGFIDO < 1.2.1 - Authentication Bypass via Device Signature Replay

Title source: llm
STIX 2.1

Description

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html

Scores

CVSS v3 8.8
EPSS 0.0067
EPSS Percentile 47.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-294
Status published
Products (1)
Changing Information Technology/CGFIDO < 1.2.1
Published Dec 31, 2024
Tracked Since Feb 18, 2026