CVE-2023-35963

What it actually does

Multiple OS command injection vulnerabilities exist in the decompression functionality of the vcd2lxt2 utility allowing arbitrary command execution when a specially crafted wave file is opened.

Why it matters to the business

Successful exploitation can allow an attacker to run arbitrary commands on systems processing untrusted wave files, leading to potential data theft, ransomware deployment, or full system takeover with high urgency due to public exploit availability.

How an attack unfolds

An attacker creates a malicious wave file embedding commands in the decompression path of vcd2lxt2; the victim is tricked into opening the file, triggering command execution without authentication.

How to fix it

Upgrade rmqtt/rmqtt (GIT) to commit c5c681e849c24189d4635acc9d5a66314835d2e9 or later; avoid opening untrusted wave files until patched.

How to confirm the fix worked

Verify the installed version includes commit c5c681e849c24189d4635acc9d5a66314835d2e9 and test that crafted wave files no longer trigger command execution.

Typical attack path

1. Craft a specially crafted wave file exploiting decompression command injection
2. Distribute the malicious file to the target via email, download, or shared storage
3. Victim opens the file using the affected vcd2lxt2 utility
4. Injected OS commands execute with the privileges of the running process

How to detect it

Review file access logs and process execution records for unexpected command invocations during wave file decompression; check for anomalous child processes spawned by vcd2lxt2.

What your security team should do

• Immediately upgrade all instances of rmqtt/rmqtt to the fixed commit c5c681e849c24189d4635acc9d5a66314835d2e9
• Restrict processing of external wave files until patches are applied
• Monitor for any new exploit activity given the available public exploit