CVE-2023-34267
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Fatek Automation FvDesigner installations by tricking users into opening malicious FPJ files. The flaw exists in FPJ file parsing where improper data validation enables out-of-bounds writes. Users of Fatek FvDesigner software are affected.
💻 Affected Systems
- Fatek Automation FvDesigner
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to compromise of the user's workstation, potentially enabling credential theft, data exfiltration, or further network reconnaissance.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially resulting in application crash but not full system compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of FPJ file format structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Fatek Automation for latest version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-765/
Restart Required: Yes
Instructions:
1. Contact Fatek Automation for patch availability
2. Download and install the latest version of FvDesigner
3. Restart the application and verify installation
🔧 Temporary Workarounds
Block FPJ file extensions
windowsPrevent execution of FPJ files at the system or network level
Application sandboxing
windowsRun FvDesigner in restricted environment with limited privileges
🧯 If You Can't Patch
- Implement strict user training about opening untrusted files
- Deploy application control policies to restrict FvDesigner execution
🔍 How to Verify
Check if Vulnerable:
Check FvDesigner version against vendor's patched version listCheck Version:
Check Help > About in FvDesigner applicationVerify Fix Applied:
Verify FvDesigner version matches or exceeds patched version from vendor📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected FPJ file processing from untrusted sources
Network Indicators:
- Downloads of FPJ files from untrusted sources
- Unusual outbound connections after FPJ file processing
SIEM Query:
Process creation events for FvDesigner.exe followed by network connections or file writes