CVE-2023-50444

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-13 · updated 2026-06-17
Weakness: CWE-307

Description

By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; and ZED! for Windows, Mac, Linux before 2023.5 include an encrypted version of sensitive user information, which could allow an unauthenticated attacker to obtain it via brute force.

Affected products

Primx Zed!: before q.2020.3; from 2023.0 before 2023.5; from q.2021.0 before q.2021.2 — fixed in 2023.5, q.2020.3, q.2021.2
Primx Zedmail: before 2023.5 — fixed in 2023.5
Primx Zonecentral: before q.2021.2; from 2023.0 before 2023.5 — fixed in 2023.5, q.2021.2

How to fix

Upgrade to a fixed version: Primx Zed! 2023.5, q.2020.3, q.2021.2; Primx Zedmail 2023.5; Primx Zonecentral 2023.5, q.2021.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-50444 or the next vulnerability affects your stack