CVE-2024-40720 Information

Description

The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website unauthenticated remote attackers can modify the HKEY_CURRENT_USER registry to execute arbitrary commands.

Reference

https://www.twcert.org.tw/tw/cp-132-7965-8285d-1.html https://www.twcert.org.tw/en/cp-139-7971-d9584-2.html