CVE-2025-6723

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption. This issue affects Chef Inspec: through 5.23 and before 7.0.107

CVSS

No CVSS.

References

Link	Resource
https://docs.chef.io/inspec/

Configurations

No configuration.

History

No history.

Information

Published : 2026-01-30 14:16

Updated : 2026-03-11 15:16

NVD link : CVE-2025-6723

Mitre link : CVE-2025-6723

CVE.ORG link : CVE-2025-6723

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-287

Improper Authentication

{"id": "CVE-2025-6723", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-30T14:16:06.510", "references": [{"url": "https://docs.chef.io/inspec/", "source": "security@progress.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption.\n\nThis issue affects Chef Inspec: through 5.23 and before 7.0.107"}, {"lang": "es", "value": "Chef InSpec hasta la versi\u00f3n 5.23 crea tuber\u00edas con nombre con controles de acceso predeterminados de Windows excesivamente permisivos. Un atacante local puede interferir con el proceso de conexi\u00f3n de la tuber\u00eda y explotar las restricciones de acceso insuficientes para asumir el contexto de ejecuci\u00f3n de InSpec, lo que podr\u00eda resultar en privilegios elevados o interrupci\u00f3n operativa.\n\nEste problema afecta a Chef Inspec: hasta la 5.23."}], "lastModified": "2026-03-11T15:16:21.340", "sourceIdentifier": "security@progress.com"}

CVE-2025-6723

JSON object

Attach tags to CVE-2025-6723

Attach tags to `CVE-2025-6723`