CVE-2023-40505 - CVE House
Back to Database
Status published Critical CVE-2023-40505

LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability

Vulnerability Description

LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createThumbnailByMovie method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19978.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40505

Credits & Attribution

No credits recorded in the NVD database.

References

More from LG

View All →
CVE-2023-6320
Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
Critical 9.1
CVE-2023-6319
Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
Critical 9.1
CVE-2023-6318
Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
Critical 9.1
CVE-2023-6317
PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction
High 7.2
CVE-2023-41181
LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability
Medium 5.3

Affected Vendor

Affected Software

Simple Editor
Vulnerable Versions:
LG Simple Editor 3.21.0

Timeline

Official Publish: May 3rd, 2024
Last Modified: September 18th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration