Back to Database
Status published
High
CVE-2023-35841
WinFlash Driver Permissions Issue
Vulnerability Description
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-35841
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Takahiro Haruyama of Broadcom
References
More from Phoenix
View All →CVE-2024-29980
Unsafe Handling of IHV UEFI Variables
Medium
4.6
CVE-2024-29979
Unsafe Handling of Phoenix UEFI Variables
Medium
4.6
CVE-2024-1598
Potential buffer overflow when handling UEFI variables
High
7.5
CVE-2024-12533
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix...
Low
3.3
CVE-2024-0762
Potential buffer overflow when handling UEFI variables
High
7.5
Affected Vendor
Phoenix
View all reports →Affected Software
WinFlash Driver
Vulnerable Versions:
0
Timeline
Official Publish:
May 14th, 2024
Last Modified:
July 28th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H