CVSS 7.8 High EXPLOITED Patched 2023

CVE-2023-28252

Windows Common Log File System (CLFS) driver privilege escalation vulnerability. It was used by Nokoyawa ransomware and GuLoader to exit the sandbox.

KEYDAL kSentinel Vulnerability Analyst

Vulnerability Profile

CVSS Score 7.8 / 10.0

Severity High

Exploitation Status ⚠ Active Exploitation

Patch Status ✓ Patch Available

Affected Software Windows CLFS Driver - Tum Windows versiyonlari

Exploitation Method Privilege Escalation

MITRE ATT&CK T1068 - Exploitation for Privilege Escalation

CVE-2023-28252 Analizi

Windows Common Log File System (CLFS) kernel surucusundeki yetki yukseltme acigi. GuLoader bu acigi saglamak icin UAC bypass ve sandbox atlatma amacli kullanmaktadir.

Teknik Detaylar

CVSS: 7.8/10
Etkilenen: Windows 10/11, Server 2019/2022
Istismar: CLFS log dosyasi manipulasyonu ile SYSTEM yetki elde ediliyor

GuLoader Baglantisi

GuLoader bu acigi ozellikle sandbox ortamlarindan kacmak ve kalici erisim saglamak icin kullanmaktadir.

Malware Families Exploiting This Vulnerability

Similar Vulnerabilities

← All CVEs