Kioware is a niche vendor providing kiosk-management and endpoint-hardening software designed to lock down public-facing terminals and thin clients. The vendor's recurring vulnerability exposure centers on its core Kioware and Kioware Server products and clusters around input-handling and command-execution weaknesses such as OS command injection and cross-site scripting, alongside authentication and path-traversal issues characteristic of privileged-access and configuration-management software. Public exploit code has been developed for vulnerabilities affecting this vendor, making timely patching of deployed kiosk infrastructure a practical necessity. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kioware over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-18435HIGH KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the | Mar 21, 2019 | 7.8 | 33 | NO | YES |
CVE-2023-34641HIGH KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dia | Jun 19, 2023 | 7.8 | 22 | NO | NO |
CVE-2024-3460HIGH In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced au | May 14, 2024 | 7.0 | 21 | NO | NO |
CVE-2024-3459HIGH KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using buil | May 14, 2024 | 7.8 | 21 | NO | NO |
CVE-2023-34642HIGH KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dia | Jun 19, 2023 | 7.8 | 21 | NO | NO |
CVE-2024-3461MEDIUM KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user | May 14, 2024 | 5.5 | 17 | NO | NO |
CVE-2022-44875MEDIUM KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in Java | Mar 6, 2023 | 5.4 | 15 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kioware.
Media articles that mention a CVE ID that affects a product developed by Kioware — matched by CVE ID, not by vendor name.