Back to overview

CVE-2023-53966

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

Metadata

CVE ID
CVE-2023-53966
State
PUBLISHED
Assigner
VulnCheck
Reserved
2025-12-19 14:03 UTC
Published
2025-12-22 21:35 UTC
Last updated
2025-12-22 22:05 UTC
Primary CWE
CWE-134
Use of Externally-Controlled Format String
Vendor / Product
SOUND4 Ltd. / SOUND4 LinkAndShare Transmitter
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
SOUND4 Ltd. SOUND4 LinkAndShare Transmitter — 1.1.2
Weakness (CWE)
CWESourceDescription
CWE-134 cna Use of Externally-Controlled Format String
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (4)
Back to overview