Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-31468. PoCs published by shinnai.
AI-analyzed exploit summary This exploit details insecure folder permissions in Inosoft VisiWin 7 up to version 2022-2.1, where the installation directory and critical executables (e.g., VisiWin7.Server.Manager.exe) are writable by the 'Everyone' group, allowing privilege escalation via file manipulation.
Description
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a fixed version.
Exploits (1)
This exploit details insecure folder permissions in Inosoft VisiWin 7 up to version 2022-2.1, where the installation directory and critical executables (e.g., VisiWin7.Server.Manager.exe) are writable by the 'Everyone' group, allowing privilege escalation via file manipulation.
References (7)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H