Eta Otp Lock
Monthly
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). TR-CERT has confirmed the issue under advisory TR-26-0730; a vendor patch exists at version 1.0.4, and no public exploit code or CISA KEV listing has been identified at time of analysis.
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). TR-CERT has confirmed the issue under advisory TR-26-0730; a vendor patch exists at version 1.0.4, and no public exploit code or CISA KEV listing has been identified at time of analysis.