CVE-2022-32961
Assigner: twcert
Published: 2022-07-12T00:00:00
State: PUBLISHED
affected: platforms: Linux
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions: lessThanOrEqual: 11 3.0.3.30306
status: affected
version: unspecified
versionType: custom
platforms: Windows
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions: lessThanOrEqual: 11 3.1.0.00002
status: affected
version: unspecified
versionType: custom
platforms: macOS
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions: lessThanOrEqual: 11 3.0.3.30404
status: affected
version: unspecified
versionType: custom
datePublic: 2022-07-12T00:00:00
descriptions: value: HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-787
description: CWE-787 Out-of-bounds Write
type: CWE
solutions: value: Download latest version
source: advisory: TVN-202206007
discovery: EXTERNAL
title: HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow
x_generator: engine: Vulnogram 0.0.9