CVE-2023-28252KEV · OVERDUECWE-122

Windows Common Log File System Driver Elevation of Privilege Vulnerability

High · published April 11, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.9th percentile for exploit probability.

1270
days past CISA
deadline
CVSS v3.1
7.8
EPSS
49%
Percentile
98.9
In the wild
Confirmed
What it is

⚡ A sneaky privilege escalation flaw in Windows could let an attacker take control of your system with just a simple exploit! 🚨 Think of it like a hotel where a guest finds an unlocked service elevator that leads straight to the penthouse. With a little knowledge, they could skip all the security checks and access rooms reserved for VIPs! If exploited, an attacker could easily elevate their privileges, allowing them to access and manipulate sensitive data or install malicious software. This could be absolutely devastating, giving them full control over your system without ever setting off alarms!

Put simply

Think of it like a hotel where a guest finds an unlocked service elevator that leads straight to the penthouse. With a little knowledge, they could skip all the security checks and access rooms reserved for VIPs! This vulnerability in the Windows Common Log File System Driver allows attackers to gain elevated privileges, essentially bypassing security measures that ordinarily protect critical system components.

What to do

If exploited, an attacker could easily elevate their privileges, allowing them to access and manipulate sensitive data or install malicious software. This could be absolutely devastating, giving them full control over your system without ever setting off alarms! To defend against this threat, make sure to patch your Windows systems with the latest updates from Microsoft. Regularly review your system's security settings to ensure no unauthorized changes have been made. 🛡️ You've got this! With these steps, you’ll boost your security and keep those sneaky vulnerabilities at bay! 🌟

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.48973 · 98.9th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-04-11T19:13Z
KEV added
2023-04-11 · due 2023-05-02
EPSS history
Timeline
  • 11 APR 19:13Z
    Windows Common Log File System Driver Elevation of Privilege Vulnerability
    cvelistv5
  • 11 APR 00:00Z
    Added to CISA KEV — remediate by May 2
    kev