Security Resilience

CVE-2023-44976

Published
01 August 2025
Modified
15 April 2026
CVSS Score v3.1 3.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
EPSS Score 0.0018 7th percentile
Risk Priority 23 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-44976 is a low-severity Exposed IOCTL with Insufficient Access Control (CWE-782) vulnerability in Paloaltonetworks (inferred from references). Its CVSS base score is 3.2 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.

CWE(s)
CWE-782

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-26125Shared CWE-782
CVE-2026-9492Shared CWE-782
CVE-2024-33218Shared CWE-782
CVE-2026-57851Shared CWE-782
CVE-2025-15641Shared CWE-782
CVE-2026-56129Shared CWE-782
CVE-2024-0141Shared CWE-782
CVE-2025-47761Shared CWE-782
CVE-2026-8797Shared CWE-782
CVE-2024-33222Shared CWE-782

Affected Assets

Paloaltonetworks
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V8.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of access authorizations on system resources, which structurally stops an IOCTL from being exposed without proper controls.

AC-6 Least Privilege good match

AC-6 requires least-privilege assignments that limit which users or processes can reach privileged IOCTL functionality.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 partial match
blocks

Directly enforces least-privilege access permissions on interfaces such as IOCTLs.

PR.IR-01 partial match
blocks

Protects environments from unauthorized logical access, which includes improperly exposed IOCTL entry points.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.2 Privileged access rights partial match
blocks

Privileged access rights directly restrict who may invoke sensitive IOCTLs.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle includes design-time access-control requirements for device interfaces.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including access controls) be identified and specified during development; it does not itself enforce, implement or prevent exploitation of an exposed IOCTL

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates security-by-design, least privilege, default-deny, and explicit access-control analysis in architecture and hardening, which reaches the authorization logic around an IOCTL; it does not guarantee that every driver or third-party component will correctly implement those principles, leaving a bounded remainder.

A.8.28 Secure coding partial match
prevents

Secure coding practices prevent omission of access-control checks on IOCTL handlers.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect missing IOCTL authorization during development.

References