CVE-2018-16545 Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic...
HighCVSS 7.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library (dll) assumed the identity of a temporary (tmp) file (isxdl.dll) and an executable file assumed the identity of a temporary file (996E.temp).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kzsoftware asset manager | <= 1.0.1188.0 | No fix listed |
| kzsoftware training manager | <= 1.0.1230.0 | No fix listed |
References
- github.com exploit third-party-advisory