CVE-2021-32033

Katalog CVE

CVSS 4.6 · Medium EPSS 0,52%

Kerentanan Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) pada protectimus slim nfc 70 firmware. Skor CVSS 3.1 4.6 (Medium) menurut NVD.

Deskripsi (NVD)

Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, an attacker with short-time physical access to a device can set the internal real-time clock (RTC) to the future, generate one-time passwords, and reset the clock to the current time. This allows the generation of valid future time-based one-time passwords without having further access to the hardware token.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.6 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/163223/Protectimus-SLIM-NFC-Time-Manipulation.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Jun/39 exploit · mailing list · advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-007.txt exploit · advisory pihak ketiga