{"id":"CVE-2023-7270","aliases":["EUVD-2023-59660","GHSA-cpqm-82vf-6wg4"],"status":"published","title":"Local Privilege Escalation via MSI installer","description":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.\n\n\n\n\n\nThe SoftMaker Office and FreeOffice MSI installer files were found to\n produce a visible conhost.exe window running as the SYSTEM user when \nusing the repair function of msiexec.exe. This allows a local, \nlow-privileged attacker to use a chain of actions, to open a fully \nfunctional cmd.exe with the privileges of the SYSTEM user.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00322,"percentile":0.25498,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2024-06-27T09:28:21Z","modified":"2026-06-17T06:52:26Z","products":[{"vendor":"microsoft","product":"office"},{"vendor":"softmaker","product":"softmaker_office"},{"vendor":"softmaker software gmbh","product":"freeoffice"},{"vendor":"softmaker software gmbh","product":"office"}],"references":[{"url":"https://r.sec-consult.com/softmaker","tags":["exploit","third-party-advisory","x_transferred"]},{"url":"https://softmaker.de/download/servicepacks","tags":["patch","x_transferred"]},{"url":"https://www.freeoffice.com/de/download/servicepacks","tags":["patch","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/5","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7270"},{"url":"https://github.com/advisories/GHSA-cpqm-82vf-6wg4"}],"sources":{"cve":[{"id":"CVE-2023-7270","title":"Local Privilege Escalation via MSI installer","description":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.\n\n\n\n\n\nThe SoftMaker Office and FreeOffice MSI installer files were found to\n produce a visible conhost.exe window running as the SYSTEM user when \nusing the repair function of msiexec.exe. This allows a local, \nlow-privileged attacker to use a chain of actions, to open a fully \nfunctional cmd.exe with the privileges of the SYSTEM user.","status":"published","published":"2024-06-27T09:28:21.528Z","modified":"2025-02-13T17:27:05.773Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59660","description":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.\n\n\n\n\n\nThe SoftMaker Office and FreeOffice MSI installer files were found to\n produce a visible conhost.exe window running as the SYSTEM user when \nusing the repair function of msiexec.exe. This allows a local, \nlow-privileged attacker to use a chain of actions, to open a fully \nfunctional cmd.exe with the privileges of the SYSTEM user.","status":"published","published":"2024-06-27T09:28:21Z","modified":"2025-02-13T17:27:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:47.607822Z"}],"ghsa":[{"id":"GHSA-cpqm-82vf-6wg4","title":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker...","description":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.\n\n\n\n\n\nThe SoftMaker Office and FreeOffice MSI installer files were found to\n produce a visible conhost.exe window running as the SYSTEM user when \nusing the repair function of msiexec.exe. This allows a local, \nlow-privileged attacker to use a chain of actions, to open a fully \nfunctional cmd.exe with the privileges of the SYSTEM user.","status":"published","published":"2024-06-27T12:30:48Z","modified":"2024-08-01T15:32:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:57:48.682212Z"}],"nvd":[{"id":"CVE-2023-7270","description":"An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.\n\n\n\n\n\nThe SoftMaker Office and FreeOffice MSI installer files were found to\n produce a visible conhost.exe window running as the SYSTEM user when \nusing the repair function of msiexec.exe. This allows a local, \nlow-privileged attacker to use a chain of actions, to open a fully \nfunctional cmd.exe with the privileges of the SYSTEM user.","status":"published","published":"2024-06-27T10:15:10.24Z","modified":"2026-06-17T06:52:26.757Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:09:17.205287Z"}]}}