title: Hicos citizen certificate client-side component - Command Injection
description: Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt system or terminate service.
problem types: CWE-78 OS Command Injection
affected:
{
platforms: Windows
product: citizen certificate client-side component
vendor: Hicos
versions:
lessThanOrEqual: 3.0.0, status: affected, version: unspecified, versionType: custom
}
{
platforms: Mac
product: citizen certificate client-side component
vendor: Hicos
versions:
lessThanOrEqual: 1.3.4.12, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Download latest version