title: HiCOS’ client-side citizen digital certificate - Double Free
description: HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.
problem types: CWE-415 Double Free
affected:
{
platforms: Linux
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.0.3.30306, status: affected, version: unspecified, versionType: custom
}
{
platforms: Windows
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.1.0.00002, status: affected, version: unspecified, versionType: custom
}
{
platforms: macOS
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.0.3.30404, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Download latest version