CVE-2024-3460 is a high severity flaw (CVSS 7.4) in KioWare for Windows, all versions through 8.34, that lets a person escape the locked down kiosk environment. The record lists no fixed version, so check with the vendor and tighten how kiosks are set up.
What's affected
The record lists KioWare for Windows, all versions through 8.34. The weakness is CWE-424 (improper protection of an alternate path), which means a path around the kiosk's restrictions was left open. The CVSS vector in the record says the attack is reached with local access, with high attack complexity, needing no privileges and no user interaction.
The description says a user can exit the software and use other applications that were already open, during a short window before the forced automatic logout. It adds conditions: external applications must be left running when KioWare starts, the attacker must know the PIN set for that KioWare instance, and the attacker must slow the application down with a specific task to stretch the window.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
No fixed version is listed in the record. The CERT Polska page it links to returned a 404 error when I tried to read it, so I could not confirm any vendor fix or advice. Check the vendor site and CERT Polska directly.
How to check if you're exposed
KioWare is installed on kiosk and shared terminals, so the work is in your asset list. Find every Windows machine that runs KioWare and read the installed version in the program's own about or version screen, then compare with 8.34.
Then check which other applications start with the kiosk, and whether the kiosk PIN is shared or easy to guess. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Inventory every KioWare for Windows install and its version.
- Contact the vendor and ask for a fixed build or written guidance for your version, and watch CERT Polska for updates.
- Do not leave other applications open when the kiosk starts, and use a unique PIN per kiosk.
- Run the kiosk under a standard user account with no access to sensitive folders.
- Add physical controls for public kiosks, such as locked cases and disabled unused ports.
Why it matters
A kiosk is useful because it limits a public user to one task. The weakness class here is an alternate path: the main door is locked, but another route, such as an external viewer or a gap in the logout timing, reaches the same resources. A locked down shell is only as strong as every program it can launch.
Good kiosk design starts from least privilege. Run the kiosk under a user account that cannot read sensitive files or start arbitrary programs, disable downloads where possible, and keep nothing else running beside it. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Does this need network access?
The vector in the record says local access is needed. The risk is a person at the machine, which matters most for public and shared kiosks.
Sources
- NVD record data for CVE-2024-3460
- CERT Polska advisory linked from the record (returned a 404 when fetched for this post): https://cert.pl/en/posts/2024/04/CVE-2024-3459
- KioWare
Last reviewed: 19 October 2026.
