TI-2023-06649 Aliases CVE-2023-7270 GHSA-cpqm-82vf-6wg4

Local Privilege Escalation via MSI installer

MEDIUM 57CWE-266Published 2024-06-27 · Updated 2025-02-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-266.

Summary

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed. The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running as the SYSTEM user when using the repair function of msiexec.exe. This allows a local, low-privileged attacker to use a chain of actions, to open a fully functional cmd.exe with the privileges of the SYSTEM user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00322 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Office (SoftMaker Software GmbH): 2024 / NX, revision 1214FreeOffice (SoftMaker Software GmbH): 2024, revision 1215

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SoftMaker Software GmbH	Office	—	2024 / NX, revision 1214	Patch available	CNA
SoftMaker Software GmbH	FreeOffice	—	2024, revision 1215	Patch available	CNA
SoftMaker Software GmbH	FreeOffice	2021 revision 1068 and later	—	No fix listed	CNA

Office VendorSoftMaker Software GmbH Affected — Fixed in 2024 / NX, revision 1214 Patch available CNA
FreeOffice VendorSoftMaker Software GmbH Affected — Fixed in 2024, revision 1215 Patch available CNA
FreeOffice VendorSoftMaker Software GmbH Affected 2021 revision 1068 and later Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:softmaker:softmaker_office:2021:::::::*	2021	—	Softmaker

cpe:2.3:a:softmaker:softmaker_office:2021:*:*:*:*:*:*:* Versions 2021 — ·Softmaker

Remediation

Fix · CNA Office (SoftMaker Software GmbH) Fixed in 2024 / NX, revision 1214
Fix · CNA FreeOffice (SoftMaker Software GmbH) Fixed in 2024, revision 1215

Timeline

2026-10-02 Threatist record created from CVE-2023-7270
2026-10-03 Alias added: GHSA-cpqm-82vf-6wg4

References

Exploit 1

https://r.sec-consult.com/softmaker

Patch 2

Other 1

http://seclists.org/fulldisclosure/2024/Jul/5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences