What’s Vulnerable › Vulnerabilities

CVE-2023-5964: 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-06 · updated 2026-06-17
• Weakness: CWE-20

Description

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients. To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.

Affected products

• 1E Platform: before 23.0 — fixed in 23.0

How to fix

Upgrade to a fixed version: 1E Platform 23.0. Check the vendor advisory for mitigations.

References

• https://exchange.1e.com/product-packs/end-user-interaction/
• https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2006/
• https://exchange.1e.com/product-packs/end-user-interaction/
• https://www.1e.com/trust-security-compliance/cve-info/

Get alerted when CVE-2023-5964 or the next vulnerability affects your stack