CVE-2023-35841: WinFlash Driver Permissions Issue
Published May 14, 2024
·Updated
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
Affected Software
2 affected components
Phoenix WinFlash Driver<4.5.0.0
Phoenixtech Winflash Windows<4.5.0.0
Event History
May 14, 2024
CVE Published
via MITRE·02:56 PM
Data Sourced
via MITRE·02:56 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-35841?
CVE-2023-35841 has a high severity due to its potential for privilege escalation and system firmware modification.
2
How do I fix CVE-2023-35841?
To fix CVE-2023-35841, update the Phoenix WinFlash Driver to version 4.5.0.0 or later.
3
What are the effects of CVE-2023-35841?
CVE-2023-35841 allows unauthorized access to critical system components, potentially allowing attackers to escalate privileges.
4
Which software is affected by CVE-2023-35841?
CVE-2023-35841 affects the Phoenix WinFlash Driver versions prior to 4.5.0.0.
5
Is CVE-2023-35841 easy to exploit?
Exploitation of CVE-2023-35841 is possible due to insufficient access controls, making it moderately easy for an attacker.