PT-2023-3771 · Fatek Automation · Fvdesigner

CVE-2023-34272 · Publicado 2023-05-31 · Atualizado 2024-05-07

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fatek Automation FvDesigner (affected versions not specified)

Description The issue is related to an uninitialized pointer in the FvDesigner software, which can be exploited to execute arbitrary code on affected systems. This can be achieved by remote attackers when a user interacts with a malicious page or opens a malicious file, specifically through the parsing of FPJ files. The lack of proper initialization of a pointer prior to accessing it is the root cause of the problem. An attacker can leverage this to execute code in the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Enumeração de Fraquezas

CWE-824

Identificadores relacionados

BDU:2023-04060

CVE-2023-34272

ZDI-23-770

Produtos afetados

Fvdesigner

Referências · 7

• https://zerodayinitiative.com/advisories/ZDI-23-770 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-34272 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04060 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34272 · Aviso do Fabricante
• https://vuldb.com/?id.231864 · Nota
• https://twitter.com/CVEnew/status/1787926504120402074 · Publicação no Twitter
• https://cybersecurity-help.cz/vdb/SB2023060125 · Nota