CVE-2023-7343
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An arbitrary code execution vulnerability in Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02. An attacker can exploit it when an administrator opens a maliciously crafted project file. Code execution occurs in the context of the HiVision process.
Risk Assessment
An attacker could take control of the administrator's workstation, potentially disrupting industrial systems and stealing data.
Recommendation
Update Hirschmann Industrial HiVision to version 08.3.02 or later. Instruct administrators not to open project files from untrusted sources.
Other vulnerabilities in Hirschmann Industrial HiVision
See all- CVE-2017-20237Critical
An authentication bypass vulnerability in Hirschmann Industrial HiVision prior to versions 06.0.07 and 07.0.03 allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges via the master service.
- CVE-2017-20238High
A vulnerability in Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations.
- CVE-2022-4987High
Hirschmann Industrial HiVision versions 08.1.03 prior to 08.1.04 and 08.2.00 contain a vulnerability in the execution of user-configured external applications. A local attacker can place a malicious binary in the execution path, leading to arbitrary code execution with elevated privileges.
Original NVD description (English source)
Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered when an administrator opens a maliciously crafted project file. Successful exploitation allows the attacker to execute code in the context of the HiVision process.