High severity · published Mar 30, 2023
CVE-2023-29059
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023
7.8
CVSS
4.4%
EPSS
No
On KEV
Description
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3C
3cx · 3cx
18.11.1213; 18.12.402; 18.12.407; 18.12.407; 18.12.416; 18.12.416 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29059
Technical Description
https://cwe.mitre.org/data/definitions/506.html
Exploit
https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
Vendor Advisory
https://www.3cx.com/blog/news/desktopapp-security-alert/
Exploit
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
Exploit
https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised
Exploit
https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
More from 3cx
9.8
CVE-2023-49954
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address
9.8
CVE-2022-28005
An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL
9.1
CVE-2021-45490
The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation
7.8
CVE-2023-27362
3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
7.8
CVE-2019-14935
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and…