CVE-2023-24491

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been discovered in the Citrix Secure Access client for Windows

which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITY\SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
CitrixCitrix Secure Access client for Windows< 23.5.1.3
citrixsecure_access_client< 23.5.1.3

References

Timeline

Published
Jul 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-244928.8A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely eCVE-2023-244935.7A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An auCVE-2023-244945.4A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning itCVE-2023-244956.5A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. CVE-2023-244964.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244974.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244987.5An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config CVE-2023-244994.6Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spoCVE-2023-24504.4The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versionCVE-2023-245006.5Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.CVE-2023-245019.8Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit.CVE-2023-245026.5Electra Central AC unit – The unit opens an AP with an easily calculated password.