OS Command Injection Vulnerability in WPS Office by Kingsoft

CVE-2023-32548

What is CVE-2023-32548?

An OS command injection vulnerability is present in WPS Office version 10.8.0.6186. This issue arises when a remote attacker, utilizing a man-in-the-middle attack, connects the WPS Office application to a malicious server. By sending specially crafted messages, the attacker can execute arbitrary operating system commands on the system running the application, potentially compromising the device's security and leading to further exploits.

References