CVE-2022-40725 PingID Desktop PIN attempt lockout bypass.
Attackers can bypass the PIN attempt lockout mechanism in PingID Desktop, allowing unlimited attempts to guess the PIN.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40725?
CVE-2022-40725 is a high-severity vulnerability in PingID Desktop for Windows, published on 25 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.
Which versions are affected by CVE-2022-40725?
It affects 1 product.
Products include Pingidentity Desktop.
How do I fix CVE-2022-40725?
No fix has been published for CVE-2022-40725 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-40725 being exploited?
There is no known exploitation of CVE-2022-40725 in the wild and no public exploit code.
Sources
Also known as GHSA-6mjq-9p26-vg33.