CVE-2023-35320
📋 TL;DR
This is a Windows privilege escalation vulnerability in the Connected User Experiences and Telemetry service. It allows authenticated attackers to gain SYSTEM-level privileges by exploiting improper file path handling. Affects Windows systems with the vulnerable service enabled.
💻 Affected Systems
- Windows 10
- Windows 11
- Windows Server 2019
- Windows Server 2022
📦 What is this software?
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full SYSTEM privileges, enabling complete system compromise, lateral movement, persistence establishment, and data exfiltration.
Likely Case
Privilege escalation from standard user to SYSTEM, allowing installation of malware, disabling security controls, and accessing sensitive system resources.
If Mitigated
Limited impact with proper network segmentation, least privilege enforcement, and endpoint protection that detects privilege escalation attempts.
🎯 Exploit Status
Requires authenticated user access. Exploitation details not publicly disclosed as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply latest Windows security updates from July 2023 or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35320
Restart Required: Yes
Instructions:
1. Apply Windows Update. 2. Install security update KB5028185 or later. 3. Restart system. 4. Verify update installation via winver or systeminfo.
🔧 Temporary Workarounds
Disable Connected User Experiences and Telemetry Service
windowsDisables the vulnerable service to prevent exploitation
sc config DiagTrack start= disabled
sc stop DiagTrack
🧯 If You Can't Patch
- Implement strict least privilege policies to limit standard user capabilities
- Monitor for privilege escalation attempts using endpoint detection and response (EDR) tools
🔍 How to Verify
Check if Vulnerable:
Check if Connected User Experiences and Telemetry service is running: sc query DiagTrackCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains KB5028185 or later security update📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with parent process DiagTrack
- Unexpected SYSTEM privilege acquisition by user processes
- Service control manager events for DiagTrack service
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND ParentProcessName="*DiagTrack*" AND NewProcessName NOT IN ("svchost.exe", "System")