CVE-2023-35841

WinFlash Driver Permissions Issue

Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.

Affected

Phoenix · WinFlash Driver

CVSS v3.1 CNA

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.35% chance of exploitation in the next 30 days, 28th percentile

Published

2024-05-14

Updated

2025-07-28

Proof-of-concept exploits (1)

• https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html

Security advisories

• https://phoenixtech.com/phoenix-security-notifications/cve-2023-35841
• https://www.phoenix.com/security-notifications/cve-2023-35841
• https://jvn.jp/en/vu/JVNVU93886750/index.html

References

• CVE Record
• NVD entry