by Kastro
Paper/Archive/CVE-2023-0104

CVE-2023-0104

Weintek EasyBuilder Pro cMT — The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.

EPSS 22%CVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 97.6.976 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.

Affected

ProductAffectedFixed inSource
EasyBuilder Pro cMT≤ 6.07.01–CNA
EasyBuilder Pro cMT≤ 6.07.02.479 –CNA
EasyBuilder Pro cMT≤ 6.08.01.349 –CNA

Scores by source

icscert (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcisa.gov/uscert/ics/advisories/icsa-23-045-01