What is CVE-2023-28388?

CVE-2023-28388 is a vulnerability in certain versions of Intel® Chipset Device Software, with a severity rating ranging from medium to high. It may allow an authenticated user to escalate their privileges via local access. Systems running Intel® Chipset Device Software versions up to, but excluding, 10.1.19444.8378 are affected. Users should update their software to mitigate this risk.

Who is impacted by this?

CVE-2023-28388 affects users with local access to systems running certain versions of Intel® Chipset Device Software. Specifically, systems with software versions up to, but not including, 10.1.19444.8378 are impacted. This vulnerability may allow authenticated users to escalate their privileges on affected systems.

What to do if CVE-2023-28388 affected you

If you're affected by the CVE-2023-28388 vulnerability, it's crucial to take action to secure your system. Follow these simple steps to mitigate the risk:

1. Visit the Intel download page to obtain the latest Intel® Chipset Device Software.

2. Update your software to version 10.1.19444.8378 or later.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-28388 vulnerability, also known as an Uncontrolled Search Path Element, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was identified on November 14, 2023, and the recommended action is to update Intel(R) Chipset Device Software to version 10.1.19444.8378 or later to mitigate the risk.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-427, an uncontrolled search path element issue in some Intel(R) Chipset Device Software.

Learn More

For a comprehensive overview of this vulnerability, consult the NVD page.

• INTEL-SA-00870

• NVD - CVE-2023-28388