Cgservisign
Monthly
Unauthenticated OS command injection in Changing CGServiSign enables a remote attacker to run arbitrary operating-system commands on a victim's machine when that victim is lured into visiting a malicious web page while CGServiSign's local service interface is running. The attacker needs no credentials and no access to the host (CVSS 4.0 8.6, PR:N, AC:L), but exploitation depends on user interaction (UI:A) plus the presence of this specific Taiwanese e-signature client with its local listener active, which meaningfully narrows the realistic target set. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the CPE is a wildcard over all versions, every deployment must be considered affected until a fixed build is published.
Unauthenticated OS command injection in Changing CGServiSign enables a remote attacker to run arbitrary operating-system commands on a victim's machine when that victim is lured into visiting a malicious web page while CGServiSign's local service interface is running. The attacker needs no credentials and no access to the host (CVSS 4.0 8.6, PR:N, AC:L), but exploitation depends on user interaction (UI:A) plus the presence of this specific Taiwanese e-signature client with its local listener active, which meaningfully narrows the realistic target set. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the CPE is a wildcard over all versions, every deployment must be considered affected until a fixed build is published.