An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution.
References
| Link | Resource |
|---|---|
| https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ | Exploit Mitigation Release Notes Third Party Advisory |
| https://research.nccgroup.com/?research=Technical%20advisories | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
06 Jun 2023, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:* |
|
| First Time |
Faronics
Microsoft windows Faronics insight Microsoft |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-346 | |
| References | (MISC) https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ - Exploit, Mitigation, Release Notes, Third Party Advisory | |
| References | (MISC) https://research.nccgroup.com/?research=Technical%20advisories - Third Party Advisory |
31 May 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-31 00:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28349
Mitre link : CVE-2023-28349
CVE.ORG link : CVE-2023-28349
JSON object : View
Products Affected
faronics
- insight
microsoft
- windows
CWE
CWE-346
Origin Validation Error