High severity · published May 24, 2023
CVE-2023-2873
A vulnerability classified as critical was found in Twister Antivirus 8
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in Twister Antivirus 8. This vulnerability affects the function 0x804f2143/0x804f217f/0x804f214b/0x80800043 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Twister Antivirus · Filseclab
8.0 through 8.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2873
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2873
Exploit
https://drive.google.com/file/d/1ABRMxr6Ek02P_WAXjyYLGQ4sHYMVQTka/view?usp=sharing
Exploit
https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2873
Permissions Required
https://vuldb.com/?ctiid.229852
Third Party Advisory
https://vuldb.com/?id.229852
More from Twister Antivirus
7.8
CVE-2023-1007
A vulnerability was found in Twister Antivirus 8.17
7.5
CVE-2023-1443
A vulnerability was found in Filseclab Twister Antivirus 8
6.5
CVE-2023-1444
A vulnerability was found in Filseclab Twister Antivirus 8
6.1
CVE-2024-1140
Twister Antivirus v8.17 is vulnerable to an Out-of-bounds Read vulnerability by triggering the 0x801120B8 IOCTL code of the filmfd.sys driver
5.5
CVE-2024-1096
Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057,…