What’s Vulnerable › Vulnerabilities

CVE-2023-27470

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-11 · updated 2026-06-17
• Weakness: CWE-367

Description

BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading to arbitrary file deletion.

Affected products

• N-able Take Control: before 7.0.43 — fixed in 7.0.43

How to fix

Upgrade to a fixed version: N-able Take Control 7.0.43. Check the vendor advisory for mitigations.

References

• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0011.md
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0011.md

Get alerted when CVE-2023-27470 or the next vulnerability affects your stack