PT-2023-5304 · Omron · Cx-Programmer

Michael Heinzl · Published 2023-08-01 · Updated 2023-08-08 · CVE-2023-38747

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CX-Programmer Included in CX-One CXONE-AL[][]D-V4 versions 9.80 and earlier

Description A heap-based buffer overflow issue exists, which can be exploited by having a user open a specially crafted CXP file. This may lead to information disclosure and/or arbitrary code execution. The vulnerability is related to a buffer overflow in memory, allowing an attacker to access confidential information or execute arbitrary code.

Recommendations For versions 9.80 and earlier, consider avoiding the use of specially crafted CXP files until a patch is available. As a temporary workaround, restrict the opening of CXP files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-05930

CVE-2023-38747

Affected Products

Cx-Programmer

References · 7

• https://ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38747 · Security Note
• https://bdu.fstec.ru/vul/2023-05930 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38747 · Vendor Advisory
• https://t.me/cvenotify/55684 · Telegram Post
• https://jvn.jp/en/vu/JVNVU93286117 · Note
• https://t.me/cibsecurity/67648 · Telegram Post