Sentinel Keys Server
Monthly
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.