CVE-2021-37909

Published: Sep 15, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: twcert@cert.org.tw (Secondary)

Description

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

Affected (1)

Products: Tssservisignadapter Project: Tssservisignadapter

Tssservisignadapter Project

1 product

Tssservisignadapter

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tssservisignadapter Project Tssservisignadapter	Up to 1.0.20.0316

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.