CVE-2023-38541

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-277 CWE-732

Affected software

Vendor	Product	Versions
n/a	Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers	before version 2.2.2.1

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.htmlVendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.htmlVendor Advisory

Timeline

Published: Jan 19, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-385437.8A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker CVE-2023-385445.5A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability c CVE-2023-385459.8This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCK CVE-2023-385463.7This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. CVE-2023-385479.8A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its CVE-2023-385484.3A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-385495.4A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-38556.1A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functional CVE-2023-385518.2A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on CVE-2023-385527.5When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a CVE-2023-385536.7In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wit CVE-2023-385545.5In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no