Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2023-28144: Debian Hotspot may let attackers gain higher privileges
CVE-2023-28144 · published 3 years ago
Summary
Versions 1.3.x and 1.4.x through 1.4.1 of Debian Hotspot can be tricked when run with custom settings. A race condition involving symbolic links and a script that changes file ownership could let a regular user elevate their rights on the system. Apply the latest update or revert to the default configuration to remove the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | hotspot | All versions |
| – | kdab | hotspot |
>= 1.3.0, <= 1.4.1 cpe:2.3:a:kdab:hotspot:*:*:*:*:*:*:*:* |
| Ubuntu:20.04:LTS | canonical | hotspot | All versions |
Original advisory text
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.
References
- https://security-tracker.debian.org/tracker/CVE-2023-28144 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-28144 Third Party Advisory
- https://github.com/KDAB/hotspot/commit/65a246ce9196462081483fd07d97678dcfe36b9c Third Party Advisory
- https://github.com/KDAB/hotspot/releases Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/03/14/8 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28144... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-28144 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-28144 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.0
High
Type
CWE-362Race Condition
Timeline
Published14 Mar 2023
Updated3 Nov 2026
First seen15 Sep 2026
Sources
CVE-2023-28144 · OSV
DEBIAN-CVE-2023-28144 · OSV
CVE-2023-28144 · NVD
UBUNTU-CVE-2023-28144 · OSV
Track software like this
Free during beta