CVE-2023-40504: LG Simple Editor readVideoInfo command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable command injection with SYSTEM-level code execution and a CVSS of 9.8, plus very high EPSS, makes this a top remediation priority.

What it is

LG Simple Editor contains an OS command injection flaw in the readVideoInfo method, where a user-supplied string is passed to a system call without validation. It allows unauthenticated remote attackers to run arbitrary code as SYSTEM on affected installations. The record does not list specific affected versions.

Impact

An attacker gains arbitrary code execution with SYSTEM privileges on the host running LG Simple Editor, leading to full compromise of the application and underlying system.

Attack surface

Reachable over the network through the readVideoInfo functionality; the CVSS vector (AV:N/PR:N/UI:N) and description state no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit tags are present in the references, but EPSS is very high (0.887, ~99.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor patch or fixed version for LG Simple Editor as soon as it is available.
• If no patch exists, remove or isolate LG Simple Editor from network access and do not expose it to untrusted networks.
• Restrict inbound access to the service with firewall rules and allow only trusted management hosts.
• Run the application under a low-privilege account instead of SYSTEM where feasible.
• Monitor vendor advisories for updated guidance on affected versions.

Detection

• Monitor process creation for child processes spawned by LG Simple Editor, especially shell or command interpreters.
• Alert on unusual outbound network connections originating from the LG Simple Editor host.
• Review application and system logs for abnormal readVideoInfo requests or malformed input.
• Use EDR to flag command-line arguments containing shell metacharacters passed to the editor process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.