CVE-2023-29059
First published: Thu Mar 30 2023(Updated: )
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 3cx 3cx | =18.11.1213 | |
| 3cx 3cx | =18.12.402 | |
| 3cx 3cx | =18.12.407 | |
| 3cx 3cx | =18.12.407 | |
| 3cx 3cx | =18.12.416 | |
| 3cx 3cx | =18.12.416 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://cwe.mitre.org/data/definitions/506.html
- https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
- https://www.3cx.com/blog/news/desktopapp-security-alert/
- https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
- https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised
- https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
Frequently Asked Questions
What is CVE-2023-29059?
CVE-2023-29059 is a vulnerability in the 3CX DesktopApp through version 18.12.416 that has embedded malicious code.
Which versions of 3CX DesktopApp are affected?
Versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp are affected.
What is the severity of CVE-2023-29059?
The severity of CVE-2023-29059 is high, with a severity score of 7.8.
How can I fix CVE-2023-29059?
To fix CVE-2023-29059, it is recommended to update to a version of 3CX DesktopApp that is not affected, such as version 18.12.417 or later.
Where can I find more information about CVE-2023-29059?
You can find more information about CVE-2023-29059 at the following references: [Reference 1](https://cwe.mitre.org/data/definitions/506.html), [Reference 2](https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/), [Reference 3](https://www.3cx.com/blog/news/desktopapp-security-alert/)
- collector/nvd-index
- vendor/3cx
- canonical/3cx 3cx
- version/3cx 3cx/18.11.1213
- version/3cx 3cx/18.12.402
- version/3cx 3cx/18.12.407
- version/3cx 3cx/18.12.416