EUVD-2026-52294
GHSA-wp8x-9jg9-r964
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with user interaction reflects file-based deserialization delivery; PR:N because the attacker supplies an external payload without needing application credentials.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.
This issue affects eta-otp-lock: before 1.0.4.
AnalysisAI
Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access to an endpoint running eta-otp-lock in any version before 1.0.4, combined with user interaction: the victim must actively open or process a maliciously crafted serialized data file within the application (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a local attack requiring user interaction but no special privileges, producing full impact across all three security pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker crafts a malicious serialized payload exploiting available gadget chains in the eta-otp-lock runtime, then places or delivers the file to a location accessible by the target user. The attacker then induces the user to open or process the payload within eta-otp-lock - for example, via a phishing message, shared network folder, or physical access - triggering deserialization and object injection that executes attacker-controlled code with the privileges of the running application. … |
| Remediation | Upgrade eta-otp-lock to version 1.0.4 or later, as confirmed by the vendor and TR-CERT advisory TR-26-0730 at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0730. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all systems running eta-otp-lock and identify which are operating on versions prior to 1.0.4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eta Otp Lock
View allSame weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today