CVE-2023-45799
📋 TL;DR
This vulnerability in MLSoft TCO!stream allows attackers to trick victims into downloading and executing arbitrary files due to insufficient permission validation. It affects all users of TCO!stream versions 8.0.22.1115 and below, potentially leading to remote code execution.
💻 Affected Systems
- MLSoft TCO!stream
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation, credential theft, or unauthorized access to sensitive data through file execution.
If Mitigated
Limited impact if network segmentation, application allowlisting, and user awareness training are implemented.
🎯 Exploit Status
The vulnerability requires user interaction (victim downloading/executing), but exploitation is straightforward once the malicious file is delivered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version above 8.0.22.1115
Vendor Advisory: https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020
Restart Required: Yes
Instructions:
1. Download the latest version from MLSoft. 2. Backup current configuration. 3. Install the update. 4. Restart the TCO!stream service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate TCO!stream servers from critical systems and limit internet access.
Application Control
windowsImplement application allowlisting to prevent execution of unauthorized files.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file execution
🔍 How to Verify
Check if Vulnerable:
Check TCO!stream version in application settings or About dialog.Check Version:
Check application GUI or registry: HKEY_LOCAL_MACHINE\SOFTWARE\MLSoft\TCO!streamVerify Fix Applied:
Verify version is above 8.0.22.1115 and test file download/execution functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected file downloads via TCO!stream
- Execution of unfamiliar executables from TCO!stream directories
Network Indicators:
- Unusual outbound connections from TCO!stream servers
- File downloads from suspicious sources
SIEM Query:
source="TCO!stream" AND (event="file_download" OR event="execute") AND file_extension IN ("exe", "bat", "ps1")