CVE-2023-53965

HighCVSS 7.8/10Last modified Oct 28, 2026

Description

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2025
Last modified
Oct 28, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-539669.8SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows throughCVE-2023-539677.5Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password withoCVE-2023-539689.8Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by eCVE-2023-539697.5Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by eCVE-2023-53978.1Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failCVE-2023-539707.5Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controlsCVE-2023-539718.8WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo uploCVE-2023-539727.5WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulatCVE-2023-539737.8Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorizeCVE-2023-539747.5D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settiCVE-2023-539757.5Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvCVE-2023-539765.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administ
CVE-2023-53965: High severity, CVSS 7.8 | Vulnix