CVE-2023-54338
Published: 13 January 2026
Summary
CVE-2023-54338 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Github (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-54338 is an unquoted service path vulnerability affecting Tftpd32 SE version 4.60. The issue resides in the service configuration, where the unquoted path enables local attackers to potentially execute arbitrary code with elevated privileges by injecting malicious executables that the system runs under system-level permissions. This flaw is classified under CWE-428 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H).
Local attackers with access to the host system can exploit this vulnerability due to its low attack complexity and lack of prerequisite privileges. By placing a malicious executable in a directory traversed before the legitimate service binary, the attacker tricks the Windows service control manager into running the payload with SYSTEM privileges, achieving high impacts on confidentiality, integrity, and availability.
Advisories and related resources include the Tftpd64 project page at https://pjo2.github.io/tftpd64/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/51076, and a VulnCheck advisory at https://www.vulncheck.com/advisories/tftpdse-tftpdsvc-unquoted-service-path. Security practitioners should review these for detailed mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2582
Vulnerability details
Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be run with…
more
system-level permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious binary placement executed at service start with SYSTEM rights.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, directly preventing unquoted service path vulnerabilities like CVE-2023-54338 by requiring properly quoted ImagePath registry values.
Requires identification, reporting, and correction of flaws such as unquoted service paths, enabling timely remediation of CVE-2023-54338 before exploitation.
Limits the impact of privilege escalation exploits like CVE-2023-54338 by enforcing least privilege for service accounts, reducing the privileges available to injected malicious executables.