Read the docs
TI-2024-02925 Aliases CVE-2024-3123GHSA-wrpr-q9f3-cqpf

CHANGING Mobile One Time Password - Arbitrary File Upload

Priority LOW 34CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00593 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CHANGINGMobile One Time Password3.11 – 3.11.3—No fix listedCNA
  • Mobile One Time Password VendorCHANGING Affected 3.11 – 3.11.3 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:changingtec:mobile_one_time_password:3.11:*:*:*:*:*:*:*3.11—CHANGING
  • cpe:2.3:a:changingtec:mobile_one_time_password:3.11:*:*:*:*:*:*:* Versions 3.11 — ·CHANGING

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3123
  2. 2026-10-03 Alias added: GHSA-wrpr-q9f3-cqpf

References

Advisory 2

  • TI-2022-18452 ChangingTec MegaServiSignAdapter - Improper Input Validation CVSS 3.1CRITICAL 9.8
  • TI-2022-18448 Changing Information Technology Inc. RAVA certificate validation system - SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-02589 Changing｜IDExpert Windows Logon Agent - Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2026-02588 Changing｜IDExpert Windows Logon Agent - Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2021-15669 CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation CVSS 3.1CRITICAL 9.8
  • TI-2020-15835 CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow CVSS 3.1CRITICAL 9.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences