Sign-up

ID

VAR-202305-2736


CVE

CVE-2023-34272


TITLE

(0Day) Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-23-770

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process

Trust: 0.72

sources: ZDI: ZDI-23-770 // VULMON: CVE-2023-34272

AFFECTED PRODUCTS

vendor:fatek automationmodel:fvdesignerscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-23-770

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2023-34272
value: HIGH

Trust: 0.7

ZDI: CVE-2023-34272
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-770

EXTERNAL IDS

db:NVDid:CVE-2023-34272

Trust: 0.8

db:ZDIid:ZDI-23-770

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-18182

Trust: 0.7

db:VULMONid:CVE-2023-34272

Trust: 0.1

sources: ZDI: ZDI-23-770 // VULMON: CVE-2023-34272

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-23-770/

Trust: 0.1

sources: VULMON: CVE-2023-34272

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-770

SOURCES

db:ZDIid:ZDI-23-770
db:VULMONid:CVE-2023-34272

LAST UPDATE DATE

2023-12-05T22:39:27.094000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-770date:2023-05-31T00:00:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-770date:2023-05-31T00:00:00