{"schemaVersion":3,"id":"CVE-2021-41992","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.","dates":{"published":"2022-04-30T21:15:19.000Z","modified":"2024-08-04T03:22:25.674Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.7,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":1.9,"severity":"low","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00504,"percentile":0.41891,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00504},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00504,"percentile":0.41891}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00504,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00504,"percentile":0.41891}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel","description":"The product requires authentication, but the product has an alternate path or channel that does not require authentication.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/288.html"},{"id":"CWE-310","name":"Cryptographic Issues","description":"Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.","type":"category","status":"Draft","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/310.html"},{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"ping identity","product":"pingid windows login","name":"PingID Windows Login","label":"pingid windows login","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 2.7","eol":null,"hubHref":"/vendor/ping_identity/pingid_windows_login"},{"vendor":"pingidentity","product":"pingid_integration_for_windows_login","name":"pingid integration for windows login","label":"pingid_integration_for_windows_login","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7","eol":null,"hubHref":"/vendor/pingidentity/pingid_integration_for_windows_login"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.pingidentity.com/en/resources/downloads/pingid.html","label":"www.pingidentity.com/en/resources/downloads/pingid.html","hostname":"www.pingidentity.com","tags":["X Refsource MISC","Product"]},{"url":"https://docs.pingidentity.com/bundle/pingid/page/klc1641469599716.html","label":"docs.pingidentity.com/bundle/pingid/page/klc1641469599716.html","hostname":"docs.pingidentity.com","tags":["X Refsource MISC","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-04-30T21:15:19.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T03:22:25.674Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:05:38.841Z","stale":false,"partial":false}}