CVE-2023-29059

HighPublic PoC

Published: 30 March 2023

Published

30 March 2023

Modified

05 May 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0043 62.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-29059 is a high-severity an unspecified weakness vulnerability in 3Cx 3Cx. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 37.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-32662

Vulnerability details

3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416…

of the 3CX DesktopApp Electron macOS application.

CWE(s): NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

3cx

18.11.1213, 18.12.402, 18.12.407, 18.12.416

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References

https://cwe.mitre.org/data/definitions/506.html
Technical Description · cve@mitre.org
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
Exploit, Technical Description, Third Party Advisory · cve@mitre.org
https://www.3cx.com/blog/news/desktopapp-security-alert/
Vendor Advisory · cve@mitre.org
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
Exploit, Third Party Advisory · cve@mitre.org
https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised
Exploit, Third Party Advisory · cve@mitre.org
https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
Exploit, Third Party Advisory · cve@mitre.org
https://cwe.mitre.org/data/definitions/506.html
Technical Description · af854a3a-2127-422b-91ae-364da2661108
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
Exploit, Technical Description, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://www.3cx.com/blog/news/desktopapp-security-alert/
Vendor Advisory · af854a3a-2127-422b-91ae-364da2661108
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
Exploit, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised
Exploit, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
Exploit, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108