Use-after-free Vulnerability in Kostac PLC Programming Software by JTEKT
CVE-2023-22424

7.8HIGH

Key Information:

Vendor

Jtekt Electronics Corporation

Status
Kostac Plc Programming Software (former Name: Koyo Plc Programming Software)
Vendor
CVE Published:
6 March 2023

What is CVE-2023-22424?

A use-after-free vulnerability exists in Kostac PLC Programming Software, enabling unauthorized access to freed memory through abnormal values set as the maximum column count in PLC program files. This flaw can be exploited by opening specially crafted project files, potentially leading to information disclosure or arbitrary code execution in affected versions.

Affected Version(s)

Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier

References

https://www.electronics.jtekt.co.jp/en/topics/202303035258/
https://www.electronics.jtekt.co.jp/jp/topics/2023030313639/
https://jvn.jp/en/vu/JVNVU94966432/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.