Security readout for executives and security teams
Plain-English summary
This flaw can let a low-privileged local user on a Windows machine running OCS Inventory NG 2.3.0.0 gain SYSTEM-level control. It is not a remote internet attack by itself, but it can turn a compromised workstation account into full host compromise.
Executive priority
Treat as high priority for managed Windows endpoints because it enables local privilege escalation to SYSTEM. It is most urgent where OCS agents run on shared workstations, servers with local users, or hosts already at elevated malware risk.
Technical view
CVE-2023-53947 is a CWE-428 unquoted service path issue in OCS Inventory NG 2.3.0.0. The CVSS 4.0 vector is local, low complexity, low privileges, no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable host.
Likely exposure
Exposure is limited to Windows systems running the affected OCS Inventory NG Windows Agent version identified in the sources, especially endpoints where local users or malware can write to directories in the service path.
Exploitation context
A public ExploitDB reference exists, but the source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires local access and the ability to influence files along the vulnerable service path before service restart.
Researcher notes
The provided affected record is sparse and lists version data inconsistently, while the title and description identify OCS Inventory NG 2.3.0.0. Validate against vendor advisories before broad scoping beyond that version.
Mitigation direction
- Check OCS Inventory NG vendor guidance for patched Windows Agent releases or supported remediation.
- Prioritize upgrades or replacement for confirmed OCS Inventory NG 2.3.0.0 Windows Agent installs.
- Quote vulnerable service executable paths where vendor-supported and operationally tested.
- Restrict non-admin write permissions on service path directories.
- Monitor for unexpected OCS service restarts and suspicious executables near service paths.
Validation and detection
- Inventory Windows endpoints for OCS Inventory NG Windows Agent installations.
- Confirm whether installed versions match OCS Inventory NG 2.3.0.0.
- Inspect the Windows service executable path for unquoted paths containing spaces.
- Review directory ACLs along the service path for non-admin write access.
- Check endpoint logs for unusual service restarts or privilege escalation indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-53947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-51389CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: OCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege EscalationCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.