Cyber Resilience

CVE-2020-23438

HighPublic PoC

Published: 04 March 2025

Published
04 March 2025
Modified
26 March 2025
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 22.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-23438 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Wondershare Filmora. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2020-23438 is a Trojan DLL hijacking vulnerability affecting Wondershare Filmora version 9.2.11, enabling privilege escalation. Mapped to CWE-427 (Untrusted Search Path), it carries a CVSS v3.1 base score of 7.8, with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability from local exploitation.

A local attacker possessing low privileges can exploit this issue with low attack complexity and no user interaction. By leveraging the DLL hijacking mechanism, the attacker can elevate privileges, potentially gaining full system control from an initial low-privilege position.

Mitigation details are available in the referenced advisory at https://cvewalkthrough.com/cve-2020-23438-wondershare-filmora-9-2-11-trojan-dll-hijacking-leading-to-privilege-escalation/. The CVE was published on 2025-03-04T21:15:10.907.

EU & UK References

Vulnerability details

Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.001 DLL Stealth
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

CVE describes DLL hijacking via untrusted search path (CWE-427) enabling local privilege escalation to full system control.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-24998Shared CWE-427
CVE-2024-10930Shared CWE-427
CVE-2019-25344Same vendor: Wondershare
CVE-2022-50900Same vendor: Wondershare
CVE-2022-50903Same vendor: Wondershare
CVE-2025-25003Shared CWE-427
CVE-2026-23741Shared CWE-427
CVE-2025-26631Shared CWE-427
CVE-2026-42171Shared CWE-427
CVE-2026-4134Shared CWE-427

Affected Assets

wondershare
filmora
≤ 9.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Flaw remediation directly addresses the known DLL hijacking vulnerability in Wondershare Filmora 9.2.11 by applying patches or vendor mitigations to prevent privilege escalation.

prevent

Least privilege ensures the Filmora application and related processes run with minimal necessary privileges, limiting the impact and success of privilege escalation via Trojan DLL hijacking.

preventdetect

Malicious code protection scans for and blocks the Trojan DLL placed by local attackers to exploit the untrusted search path vulnerability.

References