CVE-2023-35863

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://ctrl-c.club/~blue/nfsdk.htmlExploit, Technical Description, Third Party Advisory
https://www.madefornet.com/products.htmlProduct
https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.htmlBroken Link
https://ctrl-c.club/~blue/nfsdk.htmlExploit, Technical Description, Third Party Advisory
https://www.madefornet.com/products.htmlProduct
https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.htmlBroken Link

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-358665.5In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor CVE-2023-358675.9An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to CVE-2023-35872.7Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid shar CVE-2023-358707.3When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker coul CVE-2023-358719.4The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP CVE-2023-358726.5The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for cert CVE-2023-358736.5The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certa CVE-2023-358747.4SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL6 CVE-2023-358755.3Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss CVE-2023-358768.1Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from CVE-2023-358776.1Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from CVE-2023-358784.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.