CVE-2010-3321

Severity: low (CVSS 1.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-07 · updated 2026-06-16
Weakness: CWE-264

Description

RSA Authentication Client 2.0.x, 3.0, and 3.5.x before 3.5.3 does not properly handle a SENSITIVE or NON-EXTRACTABLE tag on a secret key object that is stored on a SecurID 800 authenticator, which allows local users to bypass intended access restrictions and read keys via unspecified PKCS#11 API requests.

Affected products

RSA Authentication Client: 2.0, 3.0, 3.5.1

References

http://www.securityfocus.com/archive/1/514153/100/0/threaded
http://www.securityfocus.com/bid/43795
http://www.securityfocus.com/archive/1/514153/100/0/threaded
http://www.securityfocus.com/bid/43795

Get alerted when CVE-2010-3321 or the next vulnerability affects your stack