Arbitrary File Deletion Vulnerability in Chunghwa Telecom's tbm-client

CVE-2024-12643

What is CVE-2024-12643?

CVE-2024-12643 highlights a critical security vulnerability within Chunghwa Telecom's tbm-client, where the application offers a local web server setup with insufficient Cross-Site Request Forgery (CSRF) protections in its APIs. This oversight permits unauthenticated remote attackers to exploit the APIs through various phishing tactics, leading to the potential deletion of arbitrary files from the user's system. Additionally, the presence of an Absolute Path Traversal vulnerability exacerbates the risk, allowing malicious actors to manipulate file paths and erase files that may contain sensitive user data. This vulnerability requires immediate attention to safeguard against unauthorized removal of crucial files.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References