PT-2023-8682 · Unknown · Scalefusion

Published 2023-12-01 · Updated 2025-06-20 · CVE-2023-51748

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ScaleFusion versions 10.5.2 through 10.5.6

Description The issue is related to insufficient access control in the isolated environment of Scalefusion MDM Agent, which can be exploited to impact the confidentiality, integrity, and availability of protected information. Specifically, ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.

Recommendations For versions 10.5.2 through 10.5.6, update to version 10.5.7, which prevents the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode. As a temporary workaround, consider restricting the use of Ctrl-O and Ctrl-S shortcuts in the Edge application until a patch is available.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-265

CWE-693

Related Identifiers

BDU:2024-01533

CVE-2023-51748

Affected Products

Scalefusion

References · 12

• 🔥 https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59 · Exploit
• 🔥 https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51748 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51748 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01533 · Security Note
• https://t.me/cvenotify/67076 · Telegram Post
• https://t.me/cvenotify/67907 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745466686940029195 · Twitter Post
• https://twitter.com/CVEnew/status/1745467920363200629 · Twitter Post
• https://help.scalefusion.com/docs/security-advisory-for-windows-mdm-agent · Note
• https://t.me/cvenotify/67896 · Telegram Post
• https://t.me/cvenotify/126286 · Telegram Post