Serveis / Alertes

Execució de codi de FATEK Automation FvDesigner

ALERTES

26/08/2022

CVE-2022-2866

ALT: (7.8)

CVSS3: 6.9

FATEK Automation FvDesigner podria permetre a un atacant remot executar codi arbitrari en el sistema, causat per una escriptura fora de límits en processar arxius de projecte. En persuadir a una víctima perquè obri un arxiu especialment dissenyat, un atacant podria explotar aquesta vulnerabilitat per executar codi arbitrari en el sistema.

Sistemes Afectats

  • Fatek Automation FV Designer 1.2.8.0
  • Fatek Automation FvDesigner 1.5.88

Remediació
No hi ha cap remei disponible en data de 25 d’Agost de 2022.

Referències

  • https://www.cisa.gov/uscert/ics/advisories/icsa-22-237-01
  • https://www.fatek.com/en
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1174/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1173/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1172/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1171/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1170/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1169/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1168/
  • https://www.zerodayinitiative.com/advisories/ZDI-22-1167/
  • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2866