TI-2023-27587 Aliases CVE-2023-50441 GHSA-m435-qj7x-7hx7

Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI…

LOW 24Published 2023-12-13 · Updated 2024-10-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which folders are opened.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00241 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:primx:zonecentral::::::windows::*	before q.2021.2; 2023.0 to before 2023.5	Vulnerable	Primx

cpe:2.3:a:primx:zonecentral:*:*:*:*:*:windows:*:* Versions before q.2021.2; 2023.0 to before 2023.5 Vulnerable ·Primx

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-50441
2026-10-03 Alias added: GHSA-m435-qj7x-7hx7

References

Advisory 1

https://www.primx.eu/en/bulletins/security-bulletin-23B3093A/

Other 1

https://www.primx.eu/fr/blog/

TI-2023-27590 By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI… CVSS 3.1HIGH 7.5
TI-2019-05200 Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240… CVSS 3.0MEDIUM 5.3
TI-2023-27585 ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification… CVSS 3.1MEDIUM 5.3
TI-2023-27588 Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local… CVSS 3.1MEDIUM 5.5
TI-2023-27586 ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification… CVSS 3.1MEDIUM 5.5
TI-2018-13669 PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. CVSS 3.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences