5.3med
CVE-2023-1007
Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control
Published 3 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 43%
Public exploits
0
none known
Summary
A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221740.
Exploit prediction (EPSS)
0.51% probability of exploitation in the next 30 days, higher than 43% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.3 | AV:L/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 4.3 | AV:L/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Twister Antivirus
Classification
- Weakness
- CWE-284 Improper Access Control
References
- vuldb.com /?id.221740 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.221740 · signature, permissions-required, x_transferred
- github.com /zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1007 · related, x_transferred
- drive.google.com /file/d/1wh20g2Ze4gwCtripe7QeHNXd3bS4aZNG/view?usp=sharing · exploit, x_transferred
Sources
- CVE List: CVE-2023-1007
- NVD: CVE-2023-1007
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.