Privilege Escalation Vulnerability in WinFlash Driver Allows Modification of System Firmware

CVE-2023-35841

What is CVE-2023-35841?

The Phoenix WinFlash Driver for Windows contains a vulnerability stemming from exposed IOCTL with insufficient access control. This flaw can be exploited to achieve privilege escalation, allowing unauthorized users to modify system firmware. Affected versions include WinFlash Driver released prior to 4.5.0.0. Users are advised to assess their systems and ensure they are not at risk of this vulnerability, which can potentially compromise system integrity and control.

References