CVE-2023-36344
📋 TL;DR
This vulnerability allows a local attacker to execute arbitrary code on Diebold Nixdorf Vynamic View Console systems via DLL hijacking. Attackers can place malicious DLLs in directories searched by the application, bypassing signature verification. Affected users are those running vulnerable versions of this banking software.
💻 Affected Systems
- Diebold Nixdorf Vynamic View Console
📦 What is this software?
Vynamic View by Dieboldnixdorf
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges, potentially leading to theft of banking data, manipulation of financial transactions, or deployment of ransomware.
Likely Case
Local privilege escalation allowing attackers to execute code with higher privileges than their current account, potentially compromising the banking console functionality.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only allowing code execution within user context without privilege escalation.
🎯 Exploit Status
DLL hijacking is a well-known technique with public proof-of-concept available. Requires local access but is relatively simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest version above 5.3.1
Vendor Advisory: https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/view/
Restart Required: Yes
Instructions:
1. Contact Diebold Nixdorf for latest patched version. 2. Backup current configuration. 3. Install updated version. 4. Restart system. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict DLL search paths
windowsUse application control policies to restrict where DLLs can be loaded from
Using Windows AppLocker or similar: New-AppLockerPolicy -RuleType Path -Action Deny -Path "C:\Users\*\*" -User Everyone
Remove unnecessary local accounts
windowsReduce attack surface by limiting local user accounts
net user [username] /delete
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to systems running the vulnerable software
- Deploy application whitelisting to prevent execution of unauthorized DLLs and monitor for DLL hijacking attempts
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\Diebold Nixdorf\Vynamic View ConsoleCheck Version:
reg query "HKLM\SOFTWARE\Diebold Nixdorf\Vynamic View Console" /v VersionVerify Fix Applied:
Verify version is above 5.3.1 and test DLL loading from unauthorized locations📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual paths
- Application errors related to missing or failed DLL loads
Network Indicators:
- Unusual outbound connections from the View Console process
SIEM Query:
EventID=7 OR EventID=11 AND ProcessName="*ViewConsole*" AND ImageLoaded="*.dll"🔗 References
- https://packetstormsecurity.com/files/173990/Diebold-Nixdorf-Vynamic-View-Console-5.3.1-DLL-Hijacking.html
- https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/view/
- https://packetstormsecurity.com/files/173990/Diebold-Nixdorf-Vynamic-View-Console-5.3.1-DLL-Hijacking.html
- https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/view/
