CVE-2023-5993
📋 TL;DR
A local privilege escalation vulnerability in Thales SafeNet Authentication Client for Windows allows attackers with local access to elevate their privileges to SYSTEM level. This affects Windows systems running SafeNet Authentication Client versions prior to 10.8 R10. Attackers need local access to exploit this flaw.
💻 Affected Systems
- Thales SafeNet Authentication Client
📦 What is this software?
Safenet Authentication Client by Thalesgroup
Safenet Authentication Client by Thalesgroup
Safenet Authentication Client by Thalesgroup
Safenet Authentication Client by Thalesgroup
Safenet Authentication Client by Thalesgroup
Safenet Authentication Client by Thalesgroup
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains SYSTEM privileges, enabling complete system compromise, credential theft, persistence establishment, and lateral movement capabilities.
Likely Case
Local attacker elevates from standard user to administrator/SYSTEM privileges to install malware, modify system configurations, or access protected resources.
If Mitigated
With proper access controls and least privilege principles, impact is limited to isolated systems with no critical data exposure.
🎯 Exploit Status
Local access required. Exploit likely involves manipulating Windows Installer processes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8 R10 or later
Vendor Advisory: https://supportportal.thalesgroup.com
Restart Required: Yes
Instructions:
1. Download SafeNet Authentication Client 10.8 R10 or later from Thales support portal. 2. Run installer with administrative privileges. 3. Follow installation wizard. 4. Restart system when prompted.
🔧 Temporary Workarounds
Restrict local access
windowsLimit physical and remote local access to affected systems
Apply least privilege
windowsEnsure users operate with minimal necessary privileges
🧯 If You Can't Patch
- Implement strict access controls and monitor for privilege escalation attempts
- Isolate affected systems from critical network segments and data
🔍 How to Verify
Check if Vulnerable:
Check SafeNet Authentication Client version in Control Panel > Programs and FeaturesCheck Version:
wmic product where name="SafeNet Authentication Client" get versionVerify Fix Applied:
Verify version is 10.8 R10 or later in installed programs list📡 Detection & Monitoring
Log Indicators:
- Windows Installer process execution with unusual parameters
- Privilege escalation attempts in Windows Security logs
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND ProcessName="msiexec.exe" AND CommandLine CONTAINS "SafeNet"