Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-12839: CGFIDO Device Authentication Bypass Allows Unauthorized Access
CVE-2024-12839 · published 1 year ago
Summary
A flaw in CGFIDO's device authentication allows attackers to bypass security checks. If you visit a fake website, it can steal the login signature, letting an attacker access your system with any device. Make sure to only access legitimate websites and be cautious when clicking on links.
Original advisory text
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deploye...
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-294Authentication Bypass by Capture-replay
Timeline
Published31 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-12839 · NVD
Track software like this
Free during beta