Medium severity · published Dec 25, 2023
CVE-2023-49944
The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Privilege Management For Windows · Beyondtrust
before 2023-07-14 · source: NVD
Affected product
PM
Privilege Management For Windows
Beyondtrust
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49944
Vendor Advisory
https://www.beyondtrust.com/security
Vendor Advisory
https://www.beyondtrust.com/trust-center/security-advisories/bt23-08
More from Privilege Management For Windows
8.8
CVE-2020-12613
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6
7.8
CVE-2025-2297
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under…
7.8
CVE-2025-0889
Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain…
7.8
CVE-2024-25083
An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1
7.8
CVE-2020-28369
In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp