CVE-2023-27470

CVSS 3.1 Score 7.0 of 10 (high)

Details

Published Sep 11, 2023
Updated: Sep 13, 2023
CWE ID 367

Summary

The vulnerability with the CVE ID name CVE-2023-27470 affects the N-able Take Control Agent through version 7.0.41.1141 before 7.0.43. The vulnerability is found in the BASupSrvcUpdater.exe component and is caused by a Time-of-Check Time-of-Use (TOCTOU) race condition through a pseudo-symlink located at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, which can lead to arbitrary file deletion. This vulnerability has a high risk score of 31 and a base severity rating of HIGH according to [email protected]. The exploitability score is 1.0, indicating that it is relatively easy to exploit, and it requires low privileges and no user interaction. The attack vector is local, with high impacts on integrity, confidentiality, and availability of the affected system or organization. Remediation for this vulnerability involves updating the N-able Take Control Agent to version 7.0.43 or later to mitigate the risk it poses to organizations using this software product.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-27470 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options