CVE-2023-45798: Yettiesoft VestCert Remote Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-30 · updated 2026-06-17
Weakness: CWE-829

Description

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.

Affected products

Yettiesoft VestCert: from 2.3.6 before 2.5.30 — fixed in 2.5.30

How to fix

Upgrade to a fixed version: Yettiesoft VestCert 2.5.30. Check the vendor advisory for mitigations.

References

https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020
https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020

Get alerted when CVE-2023-45798 or the next vulnerability affects your stack