Cyber Resilience

CVE-2024-58315

HighPublic PoC

Published: 30 December 2025

Published
30 December 2025
Modified
16 January 2026
KEV Added
—
Patch
—
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 9.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-58315 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Tosi Tosibox Key. Its CVSS base score is 8.5 (High).

Operationally, ranked at the 9.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting malicious code in the system root path, enabling…

more

unauthorized code execution during application startup or system reboot.

CWE(s)
CWE-428

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tosi
tosibox key
≤ 3.3.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References