Is CVE-2013-0643 actively exploited?

Yes. CVE-2013-0643 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2013-0643 be exploited remotely?

The attack vector of CVE-2013-0643 has not been classified yet.

What is the CVSS score of CVE-2013-0643?

CVE-2013-0643 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2013-0643

HIGHCISA KEVIN THE WILD

CVE-2013-0643

Published: September 17, 2024

EPSS:57.88%probability of exploitation in 30 daysPercentile:98.1th

Official Description

Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

NVD Source

CISA KEV Advisory

Adobe Flash Player Incorrect Default Permissions Vulnerability

Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

Added to KEV: 2024-09-17Federal patch deadline: 2024-10-08

Required Action (CISA)

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Risk Analysis

This high-severity vulnerability in Adobe Flash Player, specifically within the Firefox sandbox, allows remote attackers to execute arbitrary code. The flaw is due to incorrect default permissions when processing crafted SWF content. The high EPSS score and inclusion in CISA's KEV confirm active exploitation and a high likelihood of continued attacks.

This vulnerability is actively being exploited in the wild. It is remotely exploitable, typically through malicious SWF content.

Recommended Action

Users should update Adobe Flash Player to the latest secure version or consider uninstalling it if not strictly necessary. Ensure web browsers are also kept up-to-date.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2013-0643 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2013-0643 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.