Vulnerability · Published Sep 6, 2023 · Assigned by zdi
CVE-2023-32162Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability
High 7.8
In plain English
A high-severity incorrect permission assignment in Drivers for Windows from Wacom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the WacomInstallI.txt file by the PrefUtil.exe utility. The issue results from incorrect permissions on the WacomInstallI.txt file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16318.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wacom | Drivers for Windows | 6.3.45 |
Weakness: CWE-732 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Zero Day Initiative Security Advisory ZDI-23-741 x_research-advisory