CVE-2023-29059

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29066.5Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptib CVE-2023-290605.7The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor wit CVE-2023-290615.2There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this CVE-2023-290623.8The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action with CVE-2023-290632.4The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PC CVE-2023-290644.3The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the applicat CVE-2023-290654.3The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical CVE-2023-290663.5The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account CVE-2023-290677.8A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access vio CVE-2023-290687.8A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vulnerabilities in conj CVE-2023-290697.8A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with ma CVE-2023-29079.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection. This i