CVE-2022-24689

Published: Jul 18, 2022Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts.

Affected (2)

Products: Dsk: Dsknet

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dsk Dsknet	Version 2.16.136.0
Dsk Dsknet	Version 2.17.136.5

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (4)

https://dsk.lu/fr/produits/temps-de-presence

Source: cve@mitre.org

Product

https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf

Source: cve@mitre.org

ExploitThird Party Advisory

https://dsk.lu/fr/produits/temps-de-presence

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.