CVE-2012-10043
A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An attacker can exploit this vulnerability by crafting a malicious .exp file and importing it using the default character set "ECMA-94 / Latin 1 (ISO 8859)". Successful exploitation may result in arbitrary code execution, leading to full system compromise. User interaction is required to trigger the vulnerability.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 4.64%
- CWE
- CWE-121
- Published
- 2025-08-08
- Last modified
- 2026-04-07
Affected products
- ActFax Server
Weakness type
Related vulnerabilities
- CVE-2026-78910 — Buffer overflow in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside
- CVE-2026-75784 — TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow
- CVE-2026-79911 — TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow
- CVE-2026-77946 — TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
- CVE-2026-86296 — D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
- CVE-2026-76008 — Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
- CVE-2026-74843 — Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow
- CVE-2026-16872 — Vulnerabilities in IBM AIX and PowerVM VIOS