CVE-2023-35863
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
Risk Assessment
The organization may be exposed to unauthorized access to system resources by unprivileged applications, potentially leading to security breaches.
Recommendation
It is recommended to update MADEFORNET HTTP Debugger to the latest version and monitor system access for unauthorized attempts.
Original NVD description (English source)
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.