CVE-2022-27579
High
Description
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
SeverityHigh
CVSS7.8
Exploit probability—
ProductSick Flexi Soft Designer
PublishedJul 19, 2022
First seenJul 19, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- sick flexi_soft_designer1.9.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sick flexi_soft_designer | v < 1.9.4, 1.9.4 | 1.9.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.