TROYANOSYVIRUS
← Volver a CVEs

CVE-2023-41375

HIGH
7.8

Descripcion

Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.

Detalles CVE

Puntuacion CVSS v3.17.8
SeveridadHIGH
Vector CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vector de ataqueLOCAL
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioREQUIRED
Publicado9/20/2023
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0

Productos afectados

jtekt:kostac_plc

Debilidades (CWE)

CWE-416

Referencias

https://jvn.jp/en/vu/JVNVU95282683/index.html(vultures@jpcert.or.jp)
https://www.electronics.jtekt.co.jp/en/topics/202309125391/(vultures@jpcert.or.jp)
https://jvn.jp/en/vu/JVNVU95282683/index.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.electronics.jtekt.co.jp/en/topics/202309125391/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.