An object injection vulnerability in TUBITAK BILGEM eta-otp-lock could allow an attacker to achieve full system compromise via deserialization of untrusted data.

This is a CWE-502 vulnerability involving the deserialization of untrusted data. The attack vector requires local access and user interaction, but successful exploitation results in full system impact.

The ability to perform object injection through deserialization can lead to remote code execution or total system compromise. With a CVSS score of 7.8, this vulnerability represents a severe threat to the confidentiality, integrity, and availability of the host system.

Immediate Action: Update the eta-otp-lock software to version 1.0.4 or higher to resolve the deserialization flaw.

Proactive Monitoring: Review system logs for unauthorized changes or unexpected execution patterns that may indicate an attempt to leverage object injection for escalation.

Compensating Controls: Ensure that the application is running with the principle of least privilege to limit the impact of potential code execution.

Public Exploit Available: No

Administrators should apply the vendor-provided patch immediately to eliminate the risk of object injection. Given the high technical impact, patching is essential to prevent potential unauthorized access or system takeover.