CVE-2023-53984
Published: 13 January 2026
Summary
CVE-2023-53984 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 7.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2023-53984 is an unquoted service path vulnerability affecting the HKClipSvc service in Clevo HotKey Clipboard version 2.1.0.6. This misconfiguration allows local attackers to potentially execute arbitrary code with system privileges by exploiting the unquoted path in the service's executable reference. The vulnerability is rated with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428 (Unquoted Search Path or Element).
Local non-privileged users can exploit this vulnerability to achieve privilege escalation. By placing a malicious executable in specific file system locations that the Windows service manager searches due to the unquoted path, attackers can trick the HKClipSvc service into running their code with SYSTEM-level privileges upon service startup or restart.
Advisories from Vulncheck detail the privilege escalation via the unquoted service path, while an exploit proof-of-concept is publicly available on Exploit-DB. The archived Clevo vendor website provides context on the affected software component. Practitioners should consult these sources for specific mitigation guidance, such as service reconfiguration or software updates if available.
An exploit is documented on Exploit-DB, indicating practical exploitability in affected environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2604
Vulnerability details
Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged users to potentially execute code with system privileges. Attackers can exploit the misconfigured service path to inject and execute arbitrary code by…
more
placing malicious executables in specific file system locations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling path interception for SYSTEM-level execution via existing Windows service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for services, including properly quoting executable paths to directly prevent exploitation of the unquoted service path in HKClipSvc as described in CVE-2023-53984.
Enforces least privilege for service accounts, preventing privilege escalation to SYSTEM privileges even if attackers place malicious executables in search paths exploited by CVE-2023-53984.
Requires timely remediation of flaws like the unquoted service path misconfiguration in HKClipSvc, addressing CVE-2023-53984 through reconfiguration or patching.