CVE-2023-40504
Published: 03 May 2024
Summary
CVE-2023-40504 is a critical-severity OS Command Injection (CWE-78) vulnerability in Lg Simple Editor. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
LG Simple Editor contains a command injection vulnerability in the readVideoInfo method. The flaw stems from insufficient validation of a user-supplied string that is passed to a system call, enabling remote code execution. The issue was assigned CVE-2023-40504 and carries a CVSS 3.1 score of 9.8 with CWE-78 classification.
Unauthenticated remote attackers can exploit the vulnerability over the network to execute arbitrary code with SYSTEM privileges on affected installations. No user interaction or credentials are required, making the attack surface broad for any exposed LG Simple Editor instance.
The issue was publicly detailed in Zero Day Initiative advisory ZDI-23-1208, which identifies the affected component and provides technical context for the command-injection flaw. No vendor patch or mitigation guidance is referenced in the available disclosure materials.
The associated EPSS score currently stands at 0.9120 with a recorded peak of 0.9167, indicating sustained high exploitation likelihood.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45075
Vulnerability details
LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the…
more
readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19953.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.