### [CVE-2023-7270](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7270)
![](https://img.shields.io/static/v1?label=Product&message=FreeOffice&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Office&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed.The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running as the SYSTEM user when using the repair function of msiexec.exe. This allows a local, low-privileged attacker to use a chain of actions, to open a fully functional cmd.exe with the privileges of the SYSTEM user.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2024/Jul/5
- https://r.sec-consult.com/softmaker

#### Github
No PoCs found on GitHub currently.