Vulnerability · Published May 14, 2024 · Assigned by Phoenix
CVE-2023-35841WinFlash Driver Permissions Issue
High 7.8
In plain English
A high-severity incorrect permission assignment in WinFlash Driver from Phoenix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 70.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Phoenix | WinFlash Driver | 0 – before 4.5.0.0 |
Weakness: CWE-732, CWE-782 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H