CVE-2023-36853

HighCVSS 7.8

Published: 19/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. This could be exploited to load a DLL with SYSTEM privileges.

Risk Assessment

This vulnerability allows for privilege escalation, potentially leading to serious security breaches in the system. An attacker could gain full control over the system.

Recommendation

It is recommended to update the Keysight Geolocation Server to the latest version to mitigate this vulnerability. Additionally, monitor systems for unauthorized activities.

Other vulnerabilities in Keysight Geolocation Server

CVE-2023-34394High
In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to improper path validation, which could result in local privilege escalation or a denial-of-service condition.

Original NVD description (English source)

In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. The attacker could abuse this to load a DLL with SYSTEM privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS