CVE-2021-37909 CRITICAL

CVE-2021-37909: CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation

Vendor Changing Inc.
Product TSSServiSignAdapter
Weakness CWE-20 · Input validation
Published September 15, 2021
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

Key dates

02Disclosure timeline

September 15, 2021 CVE published
September 17, 2024 Record updated