CVE-2023-5964
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2023-5964 is a high-severity vulnerability that affects the 1E-Exchange-DisplayMessage instruction in the End-User Interaction product pack available on the 1E Exchange platform. This vulnerability allows malicious actors to execute arbitrary code with SYSTEM permissions by exploiting the lack of validation in the Caption or Message parameters. The affected products include tZqPzj, tZqPzi, tZqPzm, tZqPzl, and tZqPzk. To remediate this issue, users need to delete the vulnerable instruction from the Settings UI and replace it with the updated instruction called 1E-Exchange-ShowNotification, which should have a version of 7.1 or above. This vulnerability poses a significant danger to organizations as it allows unauthorized code execution on Windows clients, potentially compromising system integrity and confidentiality.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions