CVE-2023-25779

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Uncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

VendorProductVersions
n/aIntel(R) Thunderbolt(TM) DCH drivers for Windowsbefore version 88
intelthunderbolt_dch_driver< 88

References

Timeline

Published
Feb 14, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-25784.8The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users suCVE-2023-257805.7It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with noCVE-2023-257814.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sebastian Krysmanski Upload File Type Settings plugin <= 1.1 versions.CVE-2023-257824.8Auth. (admin+) vulnerability in Second2none Service Area Postcode Checker plugin <= 2.0.8 versions.CVE-2023-257834.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions.CVE-2023-257844.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bon Plan Gratos Sticky Ad Bar plugin <= 1.3.1 versions.CVE-2023-257855.3Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a CVE-2023-257864.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin <= 1.8.2 versions.CVE-2023-257874.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wbolt team WP资源下载管理 plugin <= 1.3.9 versions.CVE-2023-257888.8Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions.CVE-2023-257894.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions.CVE-2023-25795.4The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of
CVE-2023-25779: Medium severity, CVSS 6.7 | Vulnix