PT-2023-2923 · Fabulatech · Fabulatech Usb For Remote Desktop

Zeze7W · Published 2023-05-24 · Updated 2024-05-17 · CVE-2023-2871

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FabulaTech USB for Remote Desktop version 6.1.0.0

Description A vulnerability was found in the IoControlCode Handler component of FabulaTech USB for Remote Desktop, affecting the function 0x220448/0x220420/0x22040c/0x220408. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. This issue is related to errors in pointer dereferencing, which can allow an attacker to cause a denial of service.

Recommendations For FabulaTech USB for Remote Desktop version 6.1.0.0, as a temporary workaround, consider disabling the affected function 0x220448/0x220420/0x22040c/0x220408 of the IoControlCode Handler component until a patch is available. Restrict access to the IoControlCode Handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-02894

CVE-2023-2871

Affected Products

Fabulatech Usb For Remote Desktop

References · 9

• 🔥 https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2871 · Exploit
• 🔥 https://drive.google.com/file/d/1Y8e5f0AjddrozLv155r9cNhkXwwwZbYE/view?usp=sharing · Exploit
• https://bdu.fstec.ru/vul/2023-02894 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2871 · Security Note
• https://vuldb.com/?ctiid.229850 · Note
• https://vuldb.com/?id.229850 · Note
• https://t.me/cibsecurity/64712 · Telegram Post
• https://t.me/cvenotify/51080 · Telegram Post