ZDI-24-536: Fuji Electric Alpha5 C5V File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published May 31, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Alpha5 Smart. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-34579.

Affected Software

1 affected component

Fuji Electric Alpha5 Smart

Event History

May 31, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-536?

The severity of ZDI-24-536 is categorized as critical due to its potential for remote code execution.

How do I fix ZDI-24-536?

To fix ZDI-24-536, ensure that you apply the latest security patches provided by Fuji Electric for the Alpha5 Smart software.

What types of attacks can exploit ZDI-24-536?

ZDI-24-536 can be exploited through user interaction with malicious web pages or files.

Who is affected by ZDI-24-536?

Users and organizations utilizing the Fuji Electric Alpha5 Smart software are affected by ZDI-24-536.

Does ZDI-24-536 require user interaction?

Yes, ZDI-24-536 requires user interaction to successfully exploit the vulnerability.