Thalesgroup
Monthly
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private networks using TCP Port. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private networks using TCP Port. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.