CVE-2024-32482 - CVE House
Back to Database
Status published Low CVE-2024-32482

Tillitis TKey Signer possible RAM disclosure vulnerability

Vulnerability Description

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32482

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

tkey-device-signer
Vulnerable Versions:
< 1.0.0

Timeline

Official Publish: April 23rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-125 CWE-367

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1003 OS Credential Dumping
Credential Access
T1552 Unsecured Credentials
Credential Access
T1574 Hijack Execution Flow
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1036 Masquerading
Defense Evasion
T1485 Data Destruction
Impact
T1005 Data from Local System
Collection