PT-2025-32396 · Unknown · Actfax Server

Published 2025-08-08 · Updated 2025-08-08 · CVE-2012-10043

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ActFax Server version 4.32

Description: A stack-based buffer overflow vulnerability exists in the "Import Users from File" functionality of the client interface. The application does not properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An attacker can exploit this vulnerability by crafting a malicious .exp file and importing it using the default character set "ECMA-94 / Latin 1 (ISO 8859)". Successful exploitation may result in arbitrary code execution, leading to full system compromise. User interaction is required to trigger the vulnerability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2012-10043

Affected Products

Actfax Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10043 · Security Note
• https://exploit-db.com/exploits/20915 · Note
• https://web.archive.org/web/20130712072809/http://pwnag3.com/2012/08/actfax-local-privilege-escalation.html · Note
• https://vulncheck.com/advisories/actfax-client-importer-buffer-overflow · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/actfax_import_users_bof.rb · Note
• https://actfax.com · Note
• https://t.me/CVEtracker/29534 · Telegram Post