CVE-2023-2270 - CVE House
Back to Database
Status published High CVE-2023-2270

Local privilege escalation

Vulnerability Description

The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path to download and unzip configuration files on the machine. This relative path provided a way for local users to write arbitrary files at a location which is accessible to only higher privileged users. This can be exploited by local users to execute code with NT\SYSTEM privileges on the end machine.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2270

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Netskope credits Jean-Jamil Khalife from HDWSec for reporting this flaw

References

More from Netskope

View All →
CVE-2025-5942
Heap Overflow in Netskope Endpoint DLP Driver
Medium 5.7
CVE-2025-5941
Out-of-Bounds Read Vulnerability in Netskope Client
Low 2
CVE-2025-15642
Netskope Client Service Insufficient Access Controls
Medium 6.8
CVE-2025-15641
Netskope Client Exposed IOCTL with Insufficient Access Controls
Medium 6.8
CVE-2025-15584
Endpoint DLP Driver Filter Communication Port Integer Overflow
Medium 6.8

Affected Vendor

Affected Software

Netskope Client
Vulnerable Versions:
100;0

Timeline

Official Publish: June 15th, 2023
Last Modified: August 28th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact