CVE-2013-3956 describes a local privilege escalation vulnerability in the NICM.SYS kernel driver (version 3.1.11.0) of various Novell Client versions running on several Microsoft Windows operating systems, including Windows XP, Server 2003, Vista, Server 2008, Server 2008 R2, Windows 7, Windows 8, and Server 2012. An attacker can exploit this by making a crafted IOCTL call (0x143B6B) to gain elevated privileges. With a CVSS score of 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C), this vulnerability is considered highly severe, requiring local access but with low attack complexity, and potentially leading to complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code is publicly available, including a Metasploit module and entries in ExploitDB, indicating a high potential for exploitation, further supported by significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.91CPE matchmatch criteria | cpe:2.3:a:novell:client:4.91:sp5:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:a:novell:client:2.0:sp2:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:a:novell:client:2.0:sp3:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.