PT-2023-3771 · Fatek Automation · Fvdesigner

Published 2023-05-31 · Updated 2024-05-07 · CVE-2023-34272

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fatek Automation FvDesigner (affected versions not specified)

Description The issue is related to an uninitialized pointer in the FvDesigner software, which can be exploited to execute arbitrary code on affected systems. This can be achieved by remote attackers when a user interacts with a malicious page or opens a malicious file, specifically through the parsing of FPJ files. The lack of proper initialization of a pointer prior to accessing it is the root cause of the problem. An attacker can leverage this to execute code in the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2023-04060

CVE-2023-34272

ZDI-23-770

Affected Products

Fvdesigner

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-770 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34272 · Security Note
• https://bdu.fstec.ru/vul/2023-04060 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34272 · Vendor Advisory
• https://vuldb.com/?id.231864 · Note
• https://twitter.com/CVEnew/status/1787926504120402074 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023060125 · Note