Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-48387: TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTo...

CVE-2023-48387 · published 2 years ago

Summary

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
twca	jcicsecuritytool	4.2.3.32 `cpe:2.3:a:twca:jcicsecuritytool:4.2.3.32:::::::*`

Original advisory text

TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTo...

TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.

References

https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-940Improper Verification of Source of a Communication Channel

Timeline

Published15 Dec 2023

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2023-48387 · NVD

Track software like this

Free during beta