Changing Information Technology CGFIDO up to 1.2.0 Device Authentication Login authentication replay

Summaryinfo

A vulnerability was found in Changing Information Technology CGFIDO up to 1.2.0. It has been declared as critical. This vulnerability affects unknown code of the component Device Authentication Login. Such manipulation leads to authentication replay. This vulnerability is referenced as CVE-2024-12839. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Changing Information Technology CGFIDO up to 1.2.0. Affected by this issue is some unknown processing of the component Device Authentication Login. The manipulation with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability. CVE summarizes:

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

The advisory is shared for download at twcert.org.tw. This vulnerability is handled as CVE-2024-12839 since 12/20/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading to version 1.2.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Changing Information Technology

Name

• CGFIDO

Version

• 1.0
• 1.1
• 1.2.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion