What’s Vulnerable › Vulnerabilities

CVE-2021-37909: CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-15 · updated 2026-06-17
• Weakness: CWE-20

Description

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

Affected products

• CHANGING Inc. TSSServiSignAdapter: through 1.0.20.0316

References

• https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html
• https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html

Get alerted when CVE-2021-37909 or the next vulnerability affects your stack