{"vulnerability": "CVE-2023-3737", "sightings": [{"uuid": "f2aefa49-a807-4f75-b1bd-ad5536d584e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37377", "type": "seen", "source": "https://t.me/cibsecurity/70131", "content": "\u203c CVE-2023-37377 \u203c\n\nAn issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor (Exynos 980, Exynos 850, Exynos 2100, and Exynos W920). Improper handling of length parameter inconsistency can cause incorrect packet filtering.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-08T07:19:23.000000Z"}, {"uuid": "96afb963-85fe-4c06-bd70-30d7859da048", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37379", "type": "seen", "source": "https://t.me/cibsecurity/69076", "content": "\u203c CVE-2023-37379 \u203c\n\nApache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-23T20:12:56.000000Z"}, {"uuid": "ee2ea5f2-02c0-43f6-bfca-0df7646cae87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37372", "type": "seen", "source": "https://t.me/cibsecurity/67962", "content": "\u203c CVE-2023-37372 \u203c\n\nA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerable to SQL injection. This could allow an unauthenticated remote attackers to execute arbitrary SQL queries on the server database.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-08T14:15:02.000000Z"}, {"uuid": "2eead754-870a-4cf4-96e1-a60a2dcb7fc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37373", "type": "seen", "source": "https://t.me/cibsecurity/67957", "content": "\u203c CVE-2023-37373 \u203c\n\nA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-08T14:14:43.000000Z"}, {"uuid": "d823e8a9-2d9b-470e-aeac-d828fae71da4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "seen", "source": "https://t.me/cibsecurity/65886", "content": "\u203c CVE-2023-37378 \u203c\n\nNullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-04T00:22:56.000000Z"}, {"uuid": "218aeb4a-aa66-4768-8746-9fc15c863846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37375", "type": "seen", "source": "https://t.me/cibsecurity/66350", "content": "\u203c CVE-2023-37375 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21060)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-11T14:29:38.000000Z"}, {"uuid": "caf0f7d6-14d4-4c09-84d9-cd042b95f093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37374", "type": "seen", "source": "https://t.me/cibsecurity/66355", "content": "\u203c CVE-2023-37374 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21054)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-11T14:29:46.000000Z"}, {"uuid": "0af45f97-5140-41f5-8e16-63a3e6d13e53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30879", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:04.207716Z"}, {"uuid": "8ce30a3b-371b-450c-806f-6c56e5dfbaad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30878", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:04.371944Z"}, {"uuid": "7feebfa3-28bc-45dd-98da-da1fce9c2f3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30879", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:24.239758Z"}, {"uuid": "8a5c3a1f-175c-48c2-bc40-172af458b4f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30878", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:24.341564Z"}, {"uuid": "3b65ab81-6fed-4deb-98cf-9f1fede51385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17179", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:11.447870Z"}, {"uuid": "a19aedcf-4a0b-4ef9-9b04-15e0c463795f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37378", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17179", "content": "\ud83d\udd25 Zscaler NSIS Exploits \u2013 LPE Research (GitHub + Blog Analysis)\nActive GitHub PoC + vendor-focused vulnerability research (AmberWolf)\n\n\ud83d\udea8 Zscaler NSIS Uninstaller / Installer LPE Chain\n\ud83c\udfaf Local Privilege Escalation (LPE) via NSIS Abuse\n\n\ud83d\udd17 GitHub Repository\n\u27a1\ufe0f https://github.com/AmberWolfCyber/ZscalerNSISploits\n\n\ud83d\udd17 Technical Blog\n\u27a1\ufe0f https://blog.amberwolf.com/blog/2026/april/next-next-system/\n\n\ud83e\udde0 Overview\nThis research demonstrates multiple Local Privilege Escalation (LPE) vectors in Zscaler-related components by abusing NSIS (Nullsoft Scriptable Install System) installers and uninstallers.\nThe issue arises when privileged installer/uninstaller processes trust user-controlled paths or files, allowing attackers to hijack execution flow and run arbitrary code with elevated privileges.\n\n\ud83d\udd0d Affected Components\n1\ufe0f\u20e3 ZscalerRepairLPE\n\u2022 CVE-2025-43715\n\u2022 CVE-2023-37378\n\u2022 Target: Zscaler Network Adapter (\u2264 4.8)\n\n2\ufe0f\u20e3 ZscalerNpcapLPE\n\u2022 CVE-2025-43715\n\u2022 Target: NPCAP Installer (\u2264 4.7.0.168)\n\n\u2699\ufe0f Exploitation Flow\n\u2022 Trigger NSIS installer or uninstaller process\n\u2022 Leverage elevated execution context (SYSTEM / Administrator)\n\u2022 Abuse insecure file handling or path validation\n\u2022 Execute attacker-controlled payload\n\n\ud83d\udca5 Impact\n\u2022 Local Privilege Escalation \u2192 SYSTEM\n\u2022 Arbitrary code execution\n\u2022 Persistence via installer abuse\n\u2022 Security product compromise\n\n\ud83e\uddea Technical Insight\n\u2022 NSIS-based installers often run with high privileges\n\u2022 Improper validation leads to path hijacking / file planting\n\u2022 Even security-focused software can expose local attack surfaces\n\n\ud83d\udcda Research Value\n\u2022 NSIS exploitation techniques\n\u2022 Endpoint security attack surface analysis\n\u2022 Installer / uninstaller abuse patterns\n\u2022 LPE to full compromise chaining\n\n\u26a0\ufe0f Intelligence Note\nCurrent trend:\n\u2022 Security tools becoming high-value exploitation targets\n\u2022 Increasing research into installer-based privilege escalation\n\u2022 Growth in ZTNA / VPN client vulnerability discovery\n\u2022 GitHub PoC + technical blog releases happening simultaneously\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:05.044268Z"}]}