PT-2023-5518 · Kostac · Kostac Plc Programming

Michael Heinzl

·

Publicado

2023-09-20

·

Atualizado

2023-09-22

·

CVE-2023-41375

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Kostac PLC Programming Software versions 1.6.9.0 and earlier Kostac PLC Programming Software version 1.6.11.0
Description The issue is related to a use after free vulnerability, which can be exploited by opening a specially crafted project file, potentially allowing arbitrary code execution. This vulnerability exists in the parsing of KPP project files. The vendor has stated that versions 1.6.10.0 or later implement a function to prevent project file alteration.
Recommendations For Kostac PLC Programming Software versions 1.6.9.0 and earlier, save project files again using Kostac PLC Programming Software Version 1.6.10.0 or later to mitigate the impact of this vulnerability. For Kostac PLC Programming Software version 1.6.11.0, update to version 1.6.10.0 or later to prevent project file alteration and mitigate the vulnerability.

Correção

Use After Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2023-06166
CVE-2023-41375

Produtos afetados

Kostac Plc Programming