Sconnect
Monthly
Unauthenticated remote code execution affects endpoints where the Thales SConnect native host component is installed, with an attacker reaching the host through an unrestricted browser native-messaging interface from a malicious or compromised web page. Exploitation requires no credentials (CVSS vector PR:N) and only passive user interaction - the victim must visit or be redirected to an attacker-controlled page - after which crafted input bypasses the component's security checks and, per the reported analysis, chains an improper cryptographic signature verification flaw (CWE-347) with memory-management issues to achieve code execution in the native host's context. Only systems that actually deploy SConnect (a smart-card authentication component, not present by default on general endpoints) are exposed, and there is no public exploit identified at time of analysis, though the severity is rated 9.4 under CVSS 4.0 and the reported vendor is Thales.
Unauthenticated remote code execution affects endpoints where the Thales SConnect native host component is installed, with an attacker reaching the host through an unrestricted browser native-messaging interface from a malicious or compromised web page. Exploitation requires no credentials (CVSS vector PR:N) and only passive user interaction - the victim must visit or be redirected to an attacker-controlled page - after which crafted input bypasses the component's security checks and, per the reported analysis, chains an improper cryptographic signature verification flaw (CWE-347) with memory-management issues to achieve code execution in the native host's context. Only systems that actually deploy SConnect (a smart-card authentication component, not present by default on general endpoints) are exposed, and there is no public exploit identified at time of analysis, though the severity is rated 9.4 under CVSS 4.0 and the reported vendor is Thales.