CVE-2023-50440

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-13 · updated 2026-06-17
Weakness: CWE-284

Description

ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; ZED! for Windows, Mac, Linux before 2023.5; ZEDFREE for Windows, Mac, Linux before 2023.5; or ZEDPRO for Windows, Mac, Linux before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger network access to an attacker-controlled computer when opened by the victim.

Affected products

Primx Zed!: before 2023.5; before q.2020.3; from 2023.0 before 2023.5; from q.2021.0 before q.2021.2 — fixed in 2023.5, q.2020.3, q.2021.2
Primx Zedmail: before 2023.5 — fixed in 2023.5
Primx Zonecentral: before q.2021.2; from 2023.0 before 2023.5 — fixed in 2023.5, q.2021.2

How to fix

Upgrade to a fixed version: Primx Zed! 2023.5, q.2020.3, q.2021.2; Primx Zedmail 2023.5; Primx Zonecentral 2023.5, q.2021.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-50440 or the next vulnerability affects your stack