CVE-2023-46689
Intel Power Gadget ≤ 3.7.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-46689 is a high-severity Improper Neutralization (CWE-707) vulnerability in Intel Power Gadget. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50877
Vulnerability Data
Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can discover missing or incorrect neutralization logic.
Input validation directly enforces well-formed data and security properties before processing.
Output filtering enforces neutralization properties on data leaving the system.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach improper neutralization in the design/coding/testing phases, but leaves a bounded remainder (e.g. incomplete enforcement of guidelines, outsourced development without full assurance, or post-release changes) where the weakness can still be introduced and exploited.
Application security requirements explicitly call for data validation and sanitization controls addressing neutralization weaknesses.
A.8.27 mandates security-by-design principles (e.g. distrust external input, data validation/sanitization, defense-in-depth, secure architecture reviews) that reach a minority slice of improper neutralization cases but leave most instances (implementation bugs, incomplete coverage of parsers/protocols, post-design defects) unaddressed.
Secure coding standards directly require proper neutralization of inputs and outputs, eliminating CWE-707.
Security testing can detect neutralization flaws but does not itself implement the required controls.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-707, a pillar-level weakness, and none of its children carries one either.