CVE-2022-2866

2022-08-3116:15:11

CWE-787

[email protected]

web.nvd.nist.gov

fatek

fvdesigner

cve-2022-2866

vulnerability

arbitrary code execution

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

34.6%

JSON

FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using maliciously crafted project files, an attacker could achieve arbitrary code execution.

Affected configurations

NVD

Node

fatekfvdesignerRange≤1.5.103

CPENameOperatorVersion
fatek:fvdesignerfatek fvdesignerle1.5.103

CPE	Name	Operator	Version
fatek:fvdesigner	fatek fvdesigner	le	1.5.103

CNA Affected

[
  {
    "product": "FvDesigner",
    "vendor": "FATEK Automation",
    "versions": [
      {
        "lessThanOrEqual": "1.5.103",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]