Vulnerability Description
Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is "this is intended behavior as the application can be locked using a password."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Malwarebytes | Binisoft Windows Firewall Control | 6.9.2.0 |
References
- https://hackerone.com/reports/2000375Permissions Required
- https://www.bencteux.fr/posts/malwarebytes_wfc/Exploit
- https://hackerone.com/reports/2000375Permissions Required
- https://www.bencteux.fr/posts/malwarebytes_wfc/Exploit
FAQ
What is CVE-2023-36631?
CVE-2023-36631 is a vulnerability with a CVSS score of 7.8 (HIGH). Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. ...
How severe is CVE-2023-36631?
CVE-2023-36631 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-36631?
Check the references section above for vendor advisories and patch information. Affected products include: Malwarebytes Binisoft Windows Firewall Control.