CVE-2023-53875
Published: 15 December 2025
Description
GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code through DNS spoofing. Attackers can redirect victims using a malicious URL shortcut and WebDAV technique to run a reverse…
more
shell with SMB server interaction.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the RCE vulnerability in GOM Player's IE component by requiring timely patching or updates to eliminate the flaw.
Mitigates DNS spoofing attacks by enforcing secure DNS resolution with validation on caching resolvers, preventing redirection to malicious URLs.
Deploys malicious code protection mechanisms to scan for and block exploit payloads, reverse shells, or arbitrary code execution triggered via the IE component.
Security SummaryAI
CVE-2023-53875 is a remote code execution vulnerability in GOM Player version 2.3.90.5360, specifically within its Internet Explorer component. The flaw enables attackers to execute arbitrary code through DNS spoofing, as documented with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H) and mapped to CWE-319.
Remote attackers without privileges can exploit the vulnerability by redirecting victims to a malicious URL shortcut combined with a WebDAV technique. This interaction triggers a reverse shell execution involving SMB server communication, granting high-impact access to confidentiality, integrity, and availability on the victim's system, provided the user interacts with the crafted content.
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/51719, the vendor site at https://www.gomlab.com/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/gom-player-remote-code-execution-via-insecure-ie-component, though specific patch or mitigation guidance is not detailed in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote code execution flaw in GOM Player's Internet Explorer component, exploited via malicious URL shortcut and WebDAV for arbitrary code execution with user interaction, directly enabling Exploitation for Client Execution (T1203).