PT-2023-23676 · Vasion · Vasion Printerlogic Client

Publicado 2023-07-25 · Atualizado 2023-08-02 · CVE-2023-32232

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasion PrinterLogic Client for Windows versions prior to 25.0.0.836

Description An issue was discovered in the Vasion PrinterLogic Client for Windows. During client installation and repair, a PrinterLogic binary is called by the installer to configure the device. This window is not hidden and runs with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window, resulting in complete compromise via arbitrary SYSTEM code execution, which is an elevation of privileges.

Recommendations For versions prior to 25.0.0.836, update to version 25.0.0.836 or later to resolve the issue. As a temporary workaround, consider restricting access to the installer and the PrinterLogic binary to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2023-32232

Produtos afetados

Vasion Printerlogic Client

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32232 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32232 · Aviso do Fabricante
• https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm · Nota
• https://t.me/cibsecurity/67200 · Publicação no Telegram
• https://vasion.com/press-releases/printerlogic-rebrands · Aviso do Fabricante
• https://docs.printercloud.com/1-Printerlogic/Release_Notes/Security_Bulletin_CVE.htm · Nota