CVE-2023-5935
Severity CVSS v4.0:
HIGH
Type:
CWE-306
Missing Authentication for Critical Function
Publication date:
15/05/2024
Last modified:
15/04/2026
Description
When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself.<br />
<br />
<br />
<br />
A malicious local user or process, during a window of opportunity when the local web interface is active, may be able to extract sensitive information or change Arc&#39;s configuration. This could also lead to arbitrary code execution if a malicious update package is installed.
Impact
Base Score 4.0
7.30
Severity 4.0
HIGH
Base Score 3.x
7.40
Severity 3.x
HIGH