« Volver al listado

CVE-2025-24531

Estado: AplazadaMedia (6.7)—

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Opensc — PAM Pkcs11AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24531",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24531",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-16T17:54:50.924042Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "OpenSC project",
          "product": "pam_pkcs11",
          "versions": [
            {
              "status": "affected",
              "version": "0.6.12",
              "lessThan": "0.6.13",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-16T18:16:06.817",
  "references": [
    {
      "url": "https://github.com/OpenSC/pam_pkcs11/releases",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2025/02/06/3",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/02/06/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/02/06/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-393"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass."
    },
    {
      "lang": "es",
      "value": "En OpenSC pam_pkcs11 anterior a 0.6.13, pam_sm_authenticate() devuelve erróneamente PAM_IGNORE en muchas situaciones de error (como un error provocado por una tarjeta inteligente antes del inicio de sesión), lo que permite la omisión de autenticación."
    }
  ],
  "lastModified": "2026-06-17T08:59:10.870",
  "sourceIdentifier": "cve@mitre.org"
}