CVE-2024-12644

Summary

CVE-2024-12644 is a vulnerability affecting the tbm-client software from Chunghwa Telecom. This issue allows unauthenticated remote attackers to exploit the lack of Cross-Site Request Forgery (CSRF) protection in the application's APIs. By using phishing techniques, attackers can manipulate these APIs and gain access to arbitrary files on the user's system. Moreover, one of the APIs contains an Absolute Path Traversal vulnerability, enabling attackers to copy and paste files into any path they choose. This can potentially lead to information leakage or the consumption of substantial hard drive space.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.