CVE-2023-1489
📋 TL;DR
This vulnerability in Wise System Monitor allows local attackers to bypass access controls through improper handling of IoControlCode in the WiseHDInfo64.dll library. Attackers with local access can potentially escalate privileges or execute arbitrary code. Only users of WiseCleaner Wise System Monitor 1.5.3.54 are affected.
💻 Affected Systems
- Lespeed WiseCleaner Wise System Monitor
📦 What is this software?
Wise System Monitor by Wisecleaner
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to SYSTEM-level access, enabling complete system compromise, data theft, and persistence establishment.
Likely Case
Local privilege escalation allowing attackers to gain administrative privileges on the affected system.
If Mitigated
Limited impact if proper access controls restrict local user privileges and application runs with minimal permissions.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires local user access but no authentication beyond that.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider uninstalling the software or applying workarounds.
🔧 Temporary Workarounds
Uninstall Wise System Monitor
windowsRemove the vulnerable software completely from affected systems
Control Panel > Programs > Uninstall a program > Select Wise System Monitor > Uninstall
Restrict DLL permissions
windowsModify permissions on WiseHDInfo64.dll to prevent execution
icacls "C:\Program Files\Wise\Wise System Monitor\WiseHDInfo64.dll" /deny Everyone:(RX)
🧯 If You Can't Patch
- Implement strict local access controls and monitor for privilege escalation attempts
- Run Wise System Monitor with minimal user privileges (not as administrator)
🔍 How to Verify
Check if Vulnerable:
Check if Wise System Monitor version 1.5.3.54 is installed: Look in Programs and Features or check file version of WiseHDInfo64.dllCheck Version:
wmic product where name="Wise System Monitor" get versionVerify Fix Applied:
Verify Wise System Monitor is uninstalled or WiseHDInfo64.dll has restricted permissions📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Wise System Monitor
- Access denied errors for WiseHDInfo64.dll if permissions restricted
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
Process creation where parent_process contains "Wise System Monitor" and process_name contains "cmd.exe" or "powershell.exe"🔗 References
- https://drive.google.com/file/d/15k4sO3qRWDORWjU2QyOVoT_DumX6LrWu/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1489
- https://vuldb.com/?ctiid.223375
- https://vuldb.com/?id.223375
- https://drive.google.com/file/d/15k4sO3qRWDORWjU2QyOVoT_DumX6LrWu/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1489
- https://vuldb.com/?ctiid.223375
- https://vuldb.com/?id.223375
