VulnerabilityModified
CVE-2023-35863
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver.
MEDIUM 5.3EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
- EPSS
- 0.27% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- madefornet/http debugger
- Source
- cve@mitre.org
References
- https://ctrl-c.club/~blue/nfsdk.htmlExploit, Technical Description, Third Party Advisory
- https://www.madefornet.com/products.htmlProduct
- https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.htmlBroken Link
- https://ctrl-c.club/~blue/nfsdk.htmlExploit, Technical Description, Third Party Advisory
- https://www.madefornet.com/products.htmlProduct
- https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.htmlBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.