PT-2022-4451 · Fatek · Fvdesigner

Published

2022-08-25

·

Updated

2022-09-03

·

CVE-2022-2866

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FATEK FvDesigner versions 1.5.103 and prior
Description The issue is related to an out-of-bounds write in memory while processing project files. This can be exploited by an attacker to achieve arbitrary code execution if a valid user is tricked into using maliciously crafted project files.
Recommendations For FATEK FvDesigner versions 1.5.103 and prior, avoid using maliciously crafted project files to prevent arbitrary code execution. As a temporary workaround, consider restricting the use of project files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-05316
CVE-2022-2866
ZDI-22-1167
ZDI-22-1168
ZDI-22-1169
ZDI-22-1170
ZDI-22-1171
ZDI-22-1172
ZDI-22-1173
ZDI-22-1174

Affected Products

Fvdesigner