CVE-2023-48387

HIGH 8.8CVE-2023-48387 · Published 15/12/2023 · updated 17/06/2026

In short

CVE-2023-48387 is a HIGH (CVSS 8.8) vulnerability affecting jcicsecuritytool (twca).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
jcicsecuritytool twca	`= 4.2.3.32`	No fix yet

Description

TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.

References

twcert.org.tw/tw/cp-132-7602-a47a2-1.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free