{"id":"CVE-2023-29059","published":"2023-03-30T00:00:00Z","modified":"2025-05-05T16:01:52Z","title":"3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.04373,"percentile":0.91251,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-03-29","exploitedFirstSeen":"2023-03-29","ransomware":false,"evidence":[{"url":"https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/","date":"2023-03-29"},{"url":"https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/","date":"2023-03-29"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29059","date":"2023-03-30"},{"url":"https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats","date":"2023-03-30"},{"url":"https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/","date":"2023-03-31"},{"url":"https://www.rapid7.com/blog/post/2023/03/30/backdoored-3cxdesktopapp-installer-used-in-active-threat-campaign/","date":"2023-04-23"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://www.checkpoint.com/downloads/resources/2023-mid-year-cyber-security-report.pdf","date":"2023-08-25"},{"url":"https://filestore.fortinet.com/fortiguard/outbreak_alert/Outbreak_Alerts-Annual_Report_2023.pdf","date":"2024-02-20"},{"url":"https://redalert.nshc.net/2024/03/19/activity-of-hacking-group-targeted-financial-industry-in-2023-kor/","date":"2024-03-19"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Fakefolder | Ransom:Win32/CVE affecting HCA Healthcare cloud","url":"https://otx.alienvault.com/pulse/66c08b488620dac7697026c7","created":"2024-08-17"},{"name":"Caution When Using 3CX DesktopApp (CVE-2023-29059) - ASEC BLOG","url":"https://otx.alienvault.com/pulse/64352c65c4f75df9e7a93fcd","created":"2023-04-11"},{"name":"3CX Desktop App Compromised (CVE-2023-29059) | FortiGuard Labs","url":"https://otx.alienvault.com/pulse/64350b559892827f4321d329","created":"2023-04-11"},{"name":"3CX DesktopApp Supply Chain Attack Also Detected in Korea - ASEC BLOG","url":"https://otx.alienvault.com/pulse/6433d439006a90a6129ee18b","created":"2023-04-10"},{"name":"3CX Desktop App Compromised (CVE-2023-29059) | FortiGuard Labs","url":"https://otx.alienvault.com/pulse/6433a0dd20703401660cf57c","created":"2023-04-10"},{"name":"ASEC Weekly Malware Statistics (March 27th, 2023 – April 2nd, 2023) - ASEC BLOG","url":"https://otx.alienvault.com/pulse/642e8c9f6b2268c4189de3c2","created":"2023-04-06"},{"name":"Initech Product (INISAFE CrossWEB) Security Update Recommendation - ASEC BLOG","url":"https://otx.alienvault.com/pulse/642d4007228a325d98cd893a","created":"2023-04-05"},{"name":"Caution When Using 3CX DesktopApp (CVE-2023-29059) - ASEC BLOG","url":"https://otx.alienvault.com/pulse/642d3fb5ec767115fb8dff2f","created":"2023-04-05"},{"name":"“Gopuram” backdoor was deployed via 3CX supply chain attack","url":"https://otx.alienvault.com/pulse/642b69208596168a1b7444f5","created":"2023-04-04"},{"name":"3CX Desktop App Compromised","url":"https://otx.alienvault.com/pulse/642676d62236a07ec86e4e08","created":"2023-03-31"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://cwe.mitre.org/data/definitions/506.html","tags":[]},{"url":"https://www.3cx.com/blog/news/desktopapp-security-alert/","tags":[]},{"url":"https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised","tags":[]},{"url":"https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats","tags":[]},{"url":"https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/","tags":[]},{"url":"https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/","tags":[]}],"techniques":[],"reports":[{"id":"SRC-e3758f51fac4b8cf7617","title":"3CXDesktopApp Backdoored in a Suspected Lazarus Campaign","publisher":"blog.qualys.com","url":"https://blog.qualys.com/vulnerabilities-threat-research/2023/04/03/3cxdesktopapp-backdoored-in-a-suspected-lazarus-campaign","date":null,"mentions":[{"quote":"This threat is being tracked as by MITRE as CVE-2023-29059","start":1515,"end":1573}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-32662","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32662","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/","provenance":"source"},{"date":"2023-03-30","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-29059","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":64.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1310 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.25,"detail":"percentile 0.9125"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}