CVE-2018-16518
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on affected Prim'X Zed! installations through directory traversal in watermark loading. By crafting malicious ZED! containers, attackers can place executable files in the Startup folder, leading to automatic execution when users log in. All users of vulnerable versions are affected.
💻 Affected Systems
- Prim'X Zed! FREE
- Prim'X Zed! Limited Edition
📦 What is this software?
Zed\! by Primx
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with persistent malware installation, data theft, and lateral movement capabilities.
Likely Case
Malware persistence through Startup folder placement leading to credential theft, ransomware deployment, or backdoor installation.
If Mitigated
Limited impact with proper application whitelisting, restricted user privileges, and network segmentation.
🎯 Exploit Status
Exploitation requires user interaction to open malicious ZED! container but is technically simple once delivered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zed! FREE 1.0 build 187+, Zed! Limited Edition 6.1 build 2209+
Vendor Advisory: https://www.primx.eu/en/news/security-update-zed-software/
Restart Required: No
Instructions:
1. Download latest version from Prim'X website. 2. Uninstall current version. 3. Install updated version. 4. Verify version is above vulnerable builds.
🔧 Temporary Workarounds
Disable automatic startup execution
windowsRemove write permissions from Startup folders to prevent file placement
icacls "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(OI)(CI)W
icacls "%ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUp" /deny Everyone:(OI)(CI)W
Application control policy
windowsImplement application whitelisting to prevent unauthorized executables
🧯 If You Can't Patch
- Restrict user privileges to prevent writing to Startup folders
- Block ZED! container files at network perimeter and email gateways
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Zed! application and compare version/build numbers against affected rangesCheck Version:
Check via Help > About menu in application GUIVerify Fix Applied:
Confirm version is Zed! FREE 1.0 build 187+ or Zed! Limited Edition 6.1 build 2209+📡 Detection & Monitoring
Log Indicators:
- File creation events in Startup folders from Zed! process
- Zed! process writing executable files to unusual locations
Network Indicators:
- Downloads of ZED! container files from untrusted sources
- Unusual outbound connections after Zed! execution
SIEM Query:
process_name:"zed.exe" AND file_path:"*Startup*" AND file_extension:".exe"