CVE-2023-53966: linkandshare — Exploit

Description

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

Is your site exposed to CVE-2023-53966?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-134 CWE-134

Affected Products

Vendor	Product	Versions
sound4	linkandshare_transmitter	All

References

Exploits

https://www.exploit-db.com/exploits/51259 https://www.vulncheck.com/advisories/sound-linkandshare-transmitter-format-string-stack-buffer-overflow

Other References

https://web.archive.org/web/20221207074555/https://www.sound4.com/ https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5744.php https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5744.php

Frequently Asked Questions

What is CVE-2023-53966? +

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2023-53966? +

CVE-2023-53966 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2023-53966? +

CVE-2023-53966 affects products from sound4, specifically: linkandshare_transmitter. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-53966? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-6241

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly …

CVE-2024-9129

In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan …

CVE-2010-10017

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application …

CVE-2011-10029

Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing …

CVE-2012-10055

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending …

CVE-2026-10828

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort …

CVE-2023-53966