Authentication flaw

2022-03-2001:15:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.

CPENameOperatorVersion
dark_souls_iiieq<= 2022319

CPE	Name	Operator	Version
	dark_souls_iii	eq	<= 2022319

References

fromsoftware.jp

github.com/tremwil/ds3-nrssr-rce