by Kastro
Paper/Archive/CVE-2023-53966

CVE-2023-53966

SOUND4 Ltd. SOUND4 LinkAndShare Transmitter — SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

Affected

ProductAffectedFixed inSource
SOUND4 LinkAndShare Transmitter1.1.2–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51259refweb.archive.org/web/20221207074555/https://www.sound4.comexploitzeroscience.mk/en/vulnerabilities/ZSL-2023-5744.phpwriteupvulncheck.com/advisories/sound-linkandshare-transmitter-format-string-stack-buffer-overflow