Sign-up

ID

VAR-202305-2736


CVE

CVE-2023-34272


TITLE

FATEK Automation Corporation  of  FvDesigner  Vulnerability in accessing uninitialized pointers in

Trust: 0.8

sources: JVNDB: JVNDB-2023-028389

DESCRIPTION

Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18182. FATEK Automation Corporation of FvDesigner Exists in an uninitialized pointer access vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2023-34272 // JVNDB: JVNDB-2023-028389 // ZDI: ZDI-23-770 // VULMON: CVE-2023-34272

AFFECTED PRODUCTS

vendor:fatek automationmodel:fvdesignerscope: - version: -

Trust: 1.5

vendor:fatekmodel:fvdesignerscope:eqversion:1.6.24

Trust: 1.0

vendor:fatek automationmodel:fvdesignerscope:eqversion: -

Trust: 0.8

vendor:fatek automationmodel:fvdesignerscope:eqversion:1.6.24

Trust: 0.8

sources: ZDI: ZDI-23-770 // JVNDB: JVNDB-2023-028389 // NVD: CVE-2023-34272

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-34272
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-34272
value: HIGH

Trust: 1.0

NVD: CVE-2023-34272
value: HIGH

Trust: 0.8

ZDI: CVE-2023-34272
value: HIGH

Trust: 0.7

zdi-disclosures@trendmicro.com: CVE-2023-34272
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2023-34272
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2023-34272
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-770 // JVNDB: JVNDB-2023-028389 // NVD: CVE-2023-34272 // NVD: CVE-2023-34272

PROBLEMTYPE DATA

problemtype:CWE-824

Trust: 1.0

problemtype:Accessing uninitialized pointers (CWE-824) [NVD evaluation ]

Trust: 0.8

problemtype: Accessing uninitialized pointers (CWE-824) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-028389 // NVD: CVE-2023-34272

EXTERNAL IDS

db:NVDid:CVE-2023-34272

Trust: 3.4

db:ZDIid:ZDI-23-770

Trust: 2.6

db:JVNDBid:JVNDB-2023-028389

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-18182

Trust: 0.7

db:VULMONid:CVE-2023-34272

Trust: 0.1

sources: ZDI: ZDI-23-770 // VULMON: CVE-2023-34272 // JVNDB: JVNDB-2023-028389 // NVD: CVE-2023-34272

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-23-770/

Trust: 1.9

url:https://nvd.nist.gov/vuln/detail/cve-2023-34272

Trust: 0.8

sources: VULMON: CVE-2023-34272 // JVNDB: JVNDB-2023-028389 // NVD: CVE-2023-34272

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-770

SOURCES

db:ZDIid:ZDI-23-770
db:VULMONid:CVE-2023-34272
db:JVNDBid:JVNDB-2023-028389
db:NVDid:CVE-2023-34272

LAST UPDATE DATE

2025-03-15T23:22:44.602000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-770date:2023-05-31T00:00:00
db:JVNDBid:JVNDB-2023-028389date:2025-03-14T04:39:00
db:NVDid:CVE-2023-34272date:2025-03-13T16:41:49.380

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-770date:2023-05-31T00:00:00
db:JVNDBid:JVNDB-2023-028389date:2025-03-14T00:00:00
db:NVDid:CVE-2023-34272date:2024-05-03T02:15:25.970