Sign-up

ID

VAR-202305-2804


CVE

CVE-2023-34263


TITLE

(0Day) Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-23-761

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process

Trust: 0.72

sources: ZDI: ZDI-23-761 // VULMON: CVE-2023-34263

AFFECTED PRODUCTS

vendor:fatek automationmodel:fvdesignerscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-23-761

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2023-34263
value: HIGH

Trust: 0.7

ZDI: CVE-2023-34263
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-761

EXTERNAL IDS

db:NVDid:CVE-2023-34263

Trust: 0.8

db:ZDIid:ZDI-23-761

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-18162

Trust: 0.7

db:VULMONid:CVE-2023-34263

Trust: 0.1

sources: ZDI: ZDI-23-761 // VULMON: CVE-2023-34263

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-23-761/

Trust: 0.1

sources: VULMON: CVE-2023-34263

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-761

SOURCES

db:ZDIid:ZDI-23-761
db:VULMONid:CVE-2023-34263

LAST UPDATE DATE

2023-12-05T22:47:40.081000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-761date:2023-05-31T00:00:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-761date:2023-05-31T00:00:00