PT-2025-52525 · Unknown+1 · Activefaxservicent+2

Birkan Alhan · Published 2025-12-19 · Updated 2025-12-20 · CVE-2023-53954

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ActFax version 10.10

Description The software contains an unquoted service path vulnerability that may allow local attackers to escalate privileges. Specifically, the issue relates to the configuration of the ActiveFaxServiceNT service. Attackers possessing write permissions to Program Files directories can potentially inject a malicious ActSrvNT.exe executable. When the service restarts, this could grant the attacker elevated system access.

Recommendations Ensure the service path for ActiveFaxServiceNT is properly quoted. Restrict write access to Program Files directories to authorized personnel only.

Exploit

Fix

LPE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2023-53954

Affected Products

Actfax

Actsrvnt.Exe

Activefaxservicent

References · 7

• 🔥 https://exploit-db.com/exploits/51332 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53954 · Security Note
• https://twitter.com/CVEnew/status/2002466766266454084 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002146012031299717 · Twitter Post
• https://actfax.com · Note
• https://vulncheck.com/advisories/actfax-unquoted-path-services-privilege-escalation-vulnerability · Note
• https://t.me/CVEtracker/40317 · Telegram Post