CVE-2025-6723

Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption. This issue affects Chef Inspec: through 5.23.

CVSS

No CVSS.

References

Link	Resource
https://docs.chef.io/inspec/

Configurations

No configuration.

History

No history.

Information

Published : 2026-01-30 14:16

Updated : 2026-01-30 14:16

NVD link : CVE-2025-6723

Mitre link : CVE-2025-6723

CVE.ORG link : CVE-2025-6723

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-287

Improper Authentication

{"id": "CVE-2025-6723", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-30T14:16:06.510", "references": [{"url": "https://docs.chef.io/inspec/", "source": "security@progress.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption.\n\nThis issue affects Chef Inspec: through 5.23."}], "lastModified": "2026-01-30T14:16:06.510", "sourceIdentifier": "security@progress.com"}

CVE-2025-6723

JSON object

Attach tags to CVE-2025-6723

Attach tags to `CVE-2025-6723`