High severity · published Mar 13, 2023
CVE-2023-27010
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst
7.8
CVSS
1%
EPSS
No
On KEV
Description
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overwriting the executable.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Dr.fone · Wondershare
12.9.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27010
Technical Description
https://cwe.mitre.org/data/definitions/250.html
Third Party Advisory
https://packetstormsecurity.com/files/171301/Wondershare-Dr-Fone-12.9.6-Weak-Permissions-Privilege-Escalation.html
More from Dr.fone
9.8
CVE-2021-44596
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the…
8.8
CVE-2021-44595
Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and…
7.8
CVE-2022-50901
Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path
7.8
CVE-2022-50900
Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path
7.8
CVE-2025-0834
Wondershare Dr.Fone Privilege Scalation Vulnerability