CVE-2023-35080

🗓️ 14 Nov 2023 23:18:08Reported by hackeroneType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

Vulnerability in Ivanti Secure Access Windows client, allows locally authenticated attacker to exploit vulnerable configuration

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for Incorrect Default Permissions in Ivanti Secure_Access_Client	10 Feb 202416:12	–	githubexploit
BDU FSTEC	The vulnerability of the VPN server of the Ivanti Secure Access Client (ISAC) for corporate networks (formerly known as Pulse Secure Desktop Client) on Windows operating systems arises from the use of insecure configurations. This vulnerability allows attackers to gain unauthorized access to protected information, increase their privileges, or cause service interruptions.	1 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-35080	12 Feb 202400:32	–	circl
CNNVD	Ivanti Secure Access Client Security Vulnerability	14 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-35080	14 Nov 202323:18	–	cvelist
EUVD	EUVD-2023-39115	3 Oct 202520:07	–	euvd
Tenable Nessus	Ivanti Secure Access Client < 22.6R1.1 Multiple Vulnerabilities	20 Dec 202300:00	–	nessus
Kitploit	Ivanti-Pulse_VPN-Client_Exploit-CVE-2023-35080_Privilege-escalation	11 Oct 202610:37	–	kitploit
Kitploit	ivanti-cve-2023-35080-privilege-escalation-bof	8 Oct 202612:58	–	kitploit
NCSC	Vulnerabilities fixed in Ivanti Secure Access Client	13 Nov 202300:00	–	ncsc

NVD

Vulners

Node

AND

ivanti secure_access_clientRange<22.6

ivanti secure_access_clientMatch22.6r1

microsoft windowsMatch-

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Secure Access Client",
    "versions": [
      {
        "version": "22.6.1.1",
        "status": "affected",
        "lessThan": "22.6.1.1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
forums	www.forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release

Parameter	Position	Path	Description	CWE
VULN_IOCTL=0x80002018	path	\\.\jnprTdi_9117_18209	Local privilege escalation via vulnerable Ivanti Pulse VPN kernel driver using a write primitive exposed through a device IOCTL.	CWE-276
SPIN_OFFSET=0x300e9e	path	\\.\jnprTdi_9117_18209	Local privilege escalation via vulnerable Ivanti Pulse VPN kernel driver using a write primitive exposed through a device IOCTL.	CWE-276
TRY_SPIN_OFFSET=0x361757	path	\\.\jnprTdi_9117_18209	Local privilege escalation via vulnerable Ivanti Pulse VPN kernel driver using a write primitive exposed through a device IOCTL.	CWE-276
WRITE_CHAR_OFFSET=0x3d93f8	path	\\.\jnprTdi_9117_18209	Local privilege escalation via vulnerable Ivanti Pulse VPN kernel driver using a write primitive exposed through a device IOCTL.	CWE-276

17 Jun 2026 06:04Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.8

CVSS 38.8

EPSS0.00713

SSVC

CWE-276