Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt.
AnalysisAI
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt. Affected products include: Kioware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on W
In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened app
KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application fro
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today