CVE-2023-38042: 
Ivanti Secure Access Client vulnerability analysis and mitigation

CVE-2023-38042 is a local privilege escalation vulnerability discovered in Ivanti Secure Access Client for Windows. The vulnerability was disclosed in May 2024 and affects versions prior to 22.7R1. This security flaw allows a low-privileged user to execute code with SYSTEM privileges (Ivanti Advisory).

The vulnerability has been assigned a CVSS score of 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This score indicates a high-severity local vulnerability requiring low privileges and no user interaction to exploit (Ivanti Advisory).

If successfully exploited, this vulnerability allows a low-privileged user to elevate their privileges and execute code with SYSTEM-level access, potentially gaining complete control over the affected Windows system (Ivanti Advisory).

The vulnerability requires local access and low privileges to exploit. As of October 2024, there have been no public reports of this vulnerability being exploited in the wild (Hacker News).

Ivanti has released patches to address this vulnerability. Users are advised to upgrade their Secure Access Client for Windows to version 22.7R1 or later to mitigate the risk (Ivanti Advisory).