Re: Improper Authentication (CWE-287) CVE-2024-33897

Read Time:20 Second

Posted by Jeffrey Walton on Aug 22

I believe the problem lies elsewhere. The root cause is an
architectural or design problem.

Ewon Cosy+ should probably be using a protocol like Simple Certificate
Enrollment Protocol (SCEP) or Enrollment over Secure Transport (EST),
and not rolling their own scheme. Also see discussions like
<https://mailarchive.ietf.org/arch/msg/pkix/X94XpFJA5sKKkLTVkOYXL_dv8t4/>
and <>.

Jeff

Read More