PT-2023-32446 · 1E · 1E Exchange End-User Interaction

Published 2023-11-06 · Updated 2025-05-20 · CVE-2023-5964

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1E Exchange End-User Interaction product pack versions prior to 7.1

Description The 1E-Exchange-DisplayMessage instruction does not properly validate the Caption or Message parameters, allowing for arbitrary code execution with SYSTEM permissions. This issue only affects Windows clients.

Recommendations To remediate this issue, delete the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack, which should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-5964

Affected Products

1E Exchange End-User Interaction

References · 7

• https://1e.com/trust-security-compliance/cve-info · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5964 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5964 · Vendor Advisory
• https://exchange.1e.com/product-packs/end-user-interaction · Note
• https://t.me/cvenotify/123039 · Telegram Post
• https://t.me/cibsecurity/73616 · Telegram Post
• https://teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2006 · Note