CVE-2024-12645
Medium
Description
The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to read arbitrary files on the user's system.
SeverityMedium
CVSS6.5
Exploit probability—
ProductChunghwa Telecom Topm-client
PublishedDec 16, 2024
First seenDec 16, 2024
Weakness typeCWE-352Cross-site request forgery (CSRF)CWE-23CWE-23
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Chunghwa Telecom topm-client | 0.3.14 ≤ v ≤ 0.3.17 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.