CVE-2024-12646
High
Description
The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.
SeverityHigh
CVSS8.1
Exploit probability—
ProductChunghwa Telecom Topm-client
PublishedDec 16, 2024
First seenDec 16, 2024
Weakness typeCWE-352Cross-site request forgery (CSRF)CWE-36CWE-36
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Chunghwa Telecom topm-client | 0.3.14 ≤ v ≤ 0.3.17 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.