CVE-2023-53965
SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 22, 2025
- Updated
- Dec 22, 2025
- Reserved
- Dec 19, 2025
Description
SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-428 Unquoted Search Path or Element
Affected Products
| Product | Versions |
|---|---|
SOUND4 Server ServiceSOUND4 Ltd. |
|
References
- ExploitDB-51167exploit
- SOUND4 Official Websiteproduct
- Zero Science Lab Disclosure (ZSL-2022-5721)third-party-advisory
- VulnCheck Advisory: SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Paththird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.