CVE-2023-35841CWE-732CWE-782

WinFlash Driver Permissions Issue

High · published May 14, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.8th percentile
Weaknesses
CWE-732 · Incorrect Permission Assignment for Critical Resource; CWE-782 · Exposed IOCTL with Insufficient Access Control
Published
2024-05-14T14:56Z
EPSS history
Timeline
  • 14 MAY 14:56Z
    WinFlash Driver Permissions Issue
    cvelistv5