PT-2018-13607 · Primx · Prim'X Zed! Free+1

Published 2018-09-05 · Updated 2018-10-26 · CVE-2018-16518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prim'X Zed! FREE versions 1.0 build 186 and earlier Prim'X Zed! Limited Edition versions 6.1 build 2208 and earlier

Description A directory traversal issue allows for remote code execution, enabling the creation of arbitrary files on a user's workstation. This is possible through the use of crafted ZED! containers, which can be used by the watermark loading function to place an executable file into a Startup folder.

Recommendations For Prim'X Zed! FREE version 1.0 build 186 and earlier, consider disabling the watermark loading function until a patch is available. For Prim'X Zed! Limited Edition version 6.1 build 2208 and earlier, restrict access to the Startup folder to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-16518

Affected Products

Prim'X Zed! Free

Prim'X Zed! Limited Edition

References · 3

• 🔥 https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16518 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16518 · Vendor Advisory