PT-2023-4335 · Cncsoft+1 · Cncsoft+1

Simon Humbert · Publicado 2023-02-02 · Atualizado 2023-08-04 · CVE-2022-4634

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CNCSoft versions prior to 1.01.34 ScreenEditor versions prior to 1.01.5

Description The issue is caused by a stack-based buffer overflow. This could allow an attacker to remotely execute arbitrary code.

Recommendations For CNCSoft versions prior to 1.01.34, update to version 1.01.34 or later. For ScreenEditor versions prior to 1.01.5, update to version 1.01.5 or later.

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

BDU:2023-04675

CVE-2022-4634

ZDI-23-1021

Produtos afetados

Cncsoft

Screeneditor

Referências · 8

• https://zerodayinitiative.com/advisories/ZDI-23-1021 · Nota de Segurança
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-01 · Correção
• https://osv.dev/vulnerability/CVE-2022-4634 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04675 · Nota de Segurança
• https://t.me/cibsecurity/57432 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-026-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4634 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023012707 · Nota