CVE-2023-31468 Privilege escalation in n/a
Weak folder permissions allow attackers to insert malicious files that execute with SYSTEM privileges, requiring an upgrade to the fixed version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31468?
CVE-2023-31468 is a high-severity vulnerability in n/a, published on 11 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a fixed version.
Weakness: CWE-276
Which versions are affected by CVE-2023-31468?
It affects 1 product.
Products include Inosoft Visiwin 7.
How do I fix CVE-2023-31468?
No fix has been published for CVE-2023-31468 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31468 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31468 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-m9q4-fmg6-m8r5.