CVE-2024-3460 Security feature bypass in Kioware
Attackers with PIN access can bypass kiosk restrictions to launch arbitrary programs by exploiting a timing window during forced logout.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3460?
CVE-2024-3460 is a high-severity vulnerability in Kioware, published on 9 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.
Weakness: CWE-424
Which versions are affected by CVE-2024-3460?
It affects 1 product.
Products include Kioware Kioware.
How do I fix CVE-2024-3460?
No fix has been published for CVE-2024-3460 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3460 being exploited?
There is no known exploitation of CVE-2024-3460 in the wild and no public exploit code.
Other vulnerabilities in Kioware
Sources
Also known as GHSA-p8rh-53x8-6ww5.