CVE-2023-28349

Опубликовано: 31 мая 2023

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution.

Ссылки

https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00597

Низкий

8.8 High

CVSS3

Дефекты

CWE-346

Связанные уязвимости

GHSA-xpw3-h9x5-q23j

CVSS3: 8.8

github

больше 2 лет назад

BDU:2023-02982

CVSS3: 9.6

fstec

около 3 лет назад

Уязвимость компонента Teacher Console платформы управления компьютерными сетями в образовании Faronics Insight, позволяющая нарушителю выполнить произвольный код