CVE-2017-14627

EPSS 19.2%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 19.2%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

23 Sep 2017Metasploit module available

23 Sep 2017Public PoC

23 Sep 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file.

Affected products

n/a · n/a

public PoCs found — 4

cve_referencewww.exploit-db.com/exploits/42777/unverified cve_referencewww.exploit-db.com/exploits/45985/unverified exploitdbwww.exploit-db.com/exploits/45985unverified exploitdbwww.exploit-db.com/exploits/42777unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://blog.spentera.com/2017/09/19/unicode-stack-based-buffer-overflow-on-cyberlink-labelprint-2-5/https://www.exploit-db.com/exploits/42777/https://www.exploit-db.com/exploits/45985/