phjounin TFTPD64-SE tftpd64_svc.exe unquoted search path
CVE-2023-0887

7HIGH

Key Information:

Vendor

Phjounin

Status
Tftpd64-se
Vendor
CVE Published:
17 February 2023

What is CVE-2023-0887?

A vulnerability exists in TFTPD64-SE 4.64, where improper handling of the executable file tftpd64_svc.exe results in unquoted search path issues. This flaw allows a local attacker to potentially execute arbitrary code by exploiting the unquoted search path, making the exploitation complex and challenging. The vulnerability emphasizes the need for proper path handling in executable components to thwart local threats effectively.

Affected Version(s)

TFTPD64-SE 4.64

References

https://vuldb.com/?id.221351
vdb-entrytechnical-description
https://vuldb.com/?ctiid.221351
signature

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

RedHatAugust (VulDB User)
.