CVE-2021-3003

low-risk

Published 2021-05-10

Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates.

Do I need to act?

0.16% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Desktop Telematico

Affected Vendors

Agenziaentrate

References (4)

Exploit https://fibonhack.github.io/2021/desktop-telematico-mitm-to-rce

Vendor Advisory https://telematici.agenziaentrate.gov.it/Main/Desktop.jsp

Exploit https://fibonhack.github.io/2021/desktop-telematico-mitm-to-rce

Vendor Advisory https://telematici.agenziaentrate.gov.it/Main/Desktop.jsp

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal