CVE-2024-51720: medium-severity vulnerability in BlackBerry SecuSUITE
Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
SecuSUITE's authentication server doesn't use enough randomness when creating security tokens, allowing attackers to register fake devices to someone else's account. This could let an attacker impersonate the victim when logging in.
The SCA Server generates insufficient entropy in authentication tokens (CWE-307), enabling an attacker to predict or brute-force device enrollment credentials. This allows unauthorized device registration to a legitimate user's account without requiring valid credentials, compromising multi-factor authentication mechanisms.
In the same product, most dangerous first.