CVE-2023-7270

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running as the SYSTEM user when using the repair function of msiexec.exe. This allows a local, low-privileged attacker to use a chain of actions, to open a fully functional cmd.exe with the privileges of the SYSTEM user.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2024-06-27

Updated

2025-02-13

Proof-of-concept exploits (1)

• https://r.sec-consult.com/softmaker

References

• CVE Record
• NVD entry

Related

• CVE-2023-7269
• CVE-2023-7297
• CVE-2023-7268
• CVE-2023-7304
• CVE-2023-7261
• CVE-2023-7305