Skip to content
OpenAdvisories
High VDE-2024-053 1 CVE

Lenze: Install Directory with insufficient permissions

Published Sep 3, 2024 · Updated Mar 13, 2025 · Revision 3

Vendor: Lenze Product: EASY UI Designer Product: VisiWinNET Professional Product: VisiWinNET Smart

Summary

The following tools:
* VisiWinNET Smart
* VisiWinNET Professional
* EASY UI Designer
create a directory with insufficient permissions, allowing a low-level user the ability to add and modify certain files that hold SYSTEM privileges, which could lead to privilege escalation.

Details

Impact
The vulnerability allows a low-level user to escalate privileges to SYSTEM, which could lead to full system compromise.

Mitigation
Only use this tool in a protected and controlled environment to minimize network impact and to ensure that the tool is inaccessable from outside. In addition, the use of firewalls is recommended to reduce the attack surface, specially to the internet and the internal business network.

Remediation
Lenze has released version 1.6.1 of the EASY UI Designer tool, which fixes the identified security vulnerability. The other two tools are no longer recommended for new applications and are being prepared for discontinuation.

Vulnerabilities 1

  • High 7.8
    CVE-2023-31468 Public exploit

    An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\…

Revision history

  1. #3

    Fix: product version

  2. #2

    Fix: correct certvde domain, added self-reference

  3. #1

    Initial revision.

References