What’s Vulnerable › Vulnerabilities

CVE-2024-3122: CHANGING Mobile One Time Password - Arbitrary File Reading

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-01 · updated 2026-06-17
• Weakness: CWE-23

Description

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.

Affected products

• CHANGING Mobile One Time Password: from earlier through 3.11.2

References

• https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html
• https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html
• https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html
• https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html

Get alerted when CVE-2024-3122 or the next vulnerability affects your stack