7.8

CVE-2023-35841

Exploit

WinFlash Driver Permissions Issue

Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phoenixtech ≫ Winflash SwPlatformwindows Version < 4.5.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.288
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

CWE-782 Exposed IOCTL with Insufficient Access Control

The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.

https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html
Third Party Advisory
Exploit
https://jvn.jp/en/vu/JVNVU93886750/index.html
Third Party Advisory
https://www.phoenix.com/security-notifications/cve-2023-35841/
Vendor Advisory
https://phoenixtech.com/phoenix-security-notifications/cve-2023-35841/
Vendor Advisory