CVE-2023-31468

An attacker with low-privileged local access to the system can place a Trojan horse file into the "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder because the directory has weak permissions for Everyone [CWE-276]. When VisiWin subsequently runs (e.g., as a service or SYSTEM-level process), it loads the attacker's malicious file, resulting in privilege escalation to SYSTEM [ref_id=1]. The attack requires no user interaction beyond the attacker having a local user account (AV:L/PR:L/UI:N) [ref_id=2].

The vulnerability resides in the directory permissions of the "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder created by Inosoft VisiWin 7 (Runtime RT7.3 RC3 20221209.5 and prior versions). The advisory does not specify a particular source file or function; the defect is in the installer or runtime that creates this folder with weak default permissions [ref_id=1].

Inosoft recommends updating to VisiWin version 2024-1, which is the fixed version [ref_id=1]. No patch diff is provided in the bundle, so the exact code changes are unknown; however, the fix presumably corrects the default permissions on the "%PROGRAMFILES(X86)%\INOSOFT GmbH" directory so that low-privileged users cannot add or modify files that will later execute with SYSTEM privileges [ref_id=1].