External risk intelligence

DigiExam Module Integrity Flaw Allows PII Access and Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-33668

DigiExam is a client-side testing application typically installed on local workstations. The vulnerability requires local access to the machine to manipulate native modules, making it primarily a local or client-side issue rather than a service reachable via the public internet.

Digiexam

14.0.2 and earlier

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in DigiExam, affecting versions up to 14.0.2, permits attackers to access sensitive personal information and compromise accounts on shared computers due to a lack of integrity checks for its native modules. This issue could have significant implications for user data privacy and account security within the affected system.

Attackers can steal personal data and hijack accounts.
Protects sensitive user information and account integrity.
Verify DigiExam usage and assess potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target DigiExam by exploiting a weakness in how the application handles native modules. This vulnerability allows an attacker to bypass integrity checks, potentially leading to unauthorized access to sensitive personal information and the ability to take over accounts on any computer where DigiExam is installed.

No prior access needed.
Tampering with native modules.
PII access and account takeover.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthorized access to personally identifiable information (PII) and account takeovers on shared computers.

PII and user accounts on shared computers.
Attackers could manipulate native modules.
Unauthorized access and account compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

DigiExam's lack of integrity checks on native modules could allow unauthorized access to Personally Identifiable Information and account takeovers on shared computers. Action should be led by the application owners, in coordination with infrastructure and security teams, to first identify all DigiExam installations, confirm their reachability and criticality, and then plan remediation during a maintenance window.

Application owners should lead remediation efforts.
Verify DigiExam installations and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DigiExam?

DigiExam is a client-side software application primarily used in educational and professional settings to conduct secure, proctored digital examinations. It is installed directly on local workstations—such as student laptops or lab computers—to provide a controlled environment for testing, ensuring that exam integrity is maintained during the assessment process.

How does the vulnerability in CVE-2023-33668 work?

This issue is classified as Improper Validation of Integrity (CWE-354). The software fails to verify that its native modules—the background components responsible for core functionality—remain untampered. Because these modules are not checked for authenticity, a malicious actor can replace or modify them to force the application to perform unauthorized actions, such as exposing private user data or hijacking an active session.

Do I need local access to trigger this vulnerability?

Yes, this bug is effectively a client-side issue. It requires the ability to modify files on the local machine where DigiExam is installed to manipulate its native modules. You cannot trigger this flaw simply by sending network traffic to a computer; the attacker must have a foothold or physical presence on the workstation to perform the necessary file tampering.

Is my DigiExam installation at high risk?

Halo Surface Signal indicates that this is very unlikely to be an internet-facing threat. Because the vulnerability requires local access to a specific workstation to be effective, it is not a traditional remote service exploit. The risk is highest on shared computers, such as those in a school computer lab, where multiple users have the potential to alter local application files.

When should I prioritize fixing this for my users?

You should begin by auditing your environment to locate all systems running DigiExam versions 14.0.2 or older. Once identified, coordinate with your software and security teams to schedule updates. Prioritize machines used by many different people, as these shared environments present the greatest opportunity for an attacker to access and manipulate the local application files needed to exploit this flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.