PT-2023-5518 · Kostac · Kostac Plc Programming

Michael Heinzl · Published 2023-09-20 · Updated 2023-09-22 · CVE-2023-41375

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kostac PLC Programming Software versions 1.6.9.0 and earlier Kostac PLC Programming Software version 1.6.11.0

Description The issue is related to a use after free vulnerability, which can be exploited by opening a specially crafted project file, potentially allowing arbitrary code execution. This vulnerability exists in the parsing of KPP project files. The vendor has stated that versions 1.6.10.0 or later implement a function to prevent project file alteration.

Recommendations For Kostac PLC Programming Software versions 1.6.9.0 and earlier, save project files again using Kostac PLC Programming Software Version 1.6.10.0 or later to mitigate the impact of this vulnerability. For Kostac PLC Programming Software version 1.6.11.0, update to version 1.6.10.0 or later to prevent project file alteration and mitigate the vulnerability.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-06166

CVE-2023-41375

Affected Products

Kostac Plc Programming

References · 11

• https://electronics.jtekt.co.jp/en/topics/202309125391 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/698725/?sphrase_id=45629 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41375 · Security Note
• https://bdu.fstec.ru/vul/2023-06166 · Security Note
• https://t.me/cibsecurity/70787 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704446497561907242 · Twitter Post
• https://vuldb.com/ru/?id.240026 · Note
• https://twitter.com/CVEnew/status/1704418336186958022 · Twitter Post
• https://jvn.jp/en/vu/JVNVU95282683/index.html · Note
• https://t.me/cvenotify/58139 · Telegram Post