CVE-2023-35841
📋 TL;DR
This vulnerability in the Phoenix WinFlash Driver allows attackers with local access to escalate privileges by exploiting an exposed IOCTL interface with insufficient access controls. It enables modification of system firmware, affecting Windows systems running vulnerable driver versions. This primarily impacts organizations using Phoenix firmware management tools.
💻 Affected Systems
- Phoenix WinFlash Driver
📦 What is this software?
Winflash by Phoenixtech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through firmware modification, allowing persistent malware installation, data theft, and system bricking.
Likely Case
Local privilege escalation to SYSTEM level, enabling installation of malware, credential theft, and lateral movement within networks.
If Mitigated
Limited to authenticated users with local access; proper privilege separation and driver restrictions prevent exploitation.
🎯 Exploit Status
Exploitation requires local access but is straightforward once access is obtained; similar driver vulnerabilities have been weaponized in malware.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.0.0
Vendor Advisory: https://phoenixtech.com/phoenix-security-notifications/cve-2023-35841/
Restart Required: Yes
Instructions:
1. Download WinFlash Driver version 4.5.0.0 or later from Phoenix website. 2. Uninstall current vulnerable driver. 3. Install updated driver. 4. Reboot system.
🔧 Temporary Workarounds
Driver Removal
windowsRemove the vulnerable WinFlash Driver if not required for system functionality
pnputil /delete-driver oem#.inf /uninstall
sc delete WinFlash
Driver Blocking
windowsUse Windows Driver Block Rules to prevent vulnerable driver loading
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Driver Security" /v "DriverBlockRules" /t REG_SZ /d "PhoenixWinFlash.inf" /f
🧯 If You Can't Patch
- Restrict local access to systems; implement least privilege principles
- Monitor for suspicious driver loading events and IOCTL calls
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager under System devices or run: driverquery | findstr WinFlashCheck Version:
driverquery /fo csv | findstr WinFlashVerify Fix Applied:
Verify driver version is 4.5.0.0 or higher using driverquery or Device Manager📡 Detection & Monitoring
Log Indicators:
- Event ID 7045: Service installation for WinFlash
- Suspicious driver loading events
- Unexpected IOCTL calls to WinFlash driver
Network Indicators:
- Not network exploitable; focus on host-based indicators
SIEM Query:
EventID=7045 AND ServiceName="WinFlash" OR ProcessName="WinFlash"🔗 References
- https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html
- https://jvn.jp/en/vu/JVNVU93886750/index.html
- https://phoenixtech.com/phoenix-security-notifications/cve-2023-35841/
- https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html
- https://jvn.jp/en/vu/JVNVU93886750/index.html
- https://www.phoenix.com/security-notifications/cve-2023-35841/
