Skip to content
fr Sign in
7.4 High

CVE-2023-5935 When configuring Arc (e.g

Description

When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. A malicious local user or process, during a window of opportunity when the local web interface is active, may be able to extract sensitive information or change Arc's configuration. This could also lead to arbitrary code execution if a malicious update package is installed.

Affected products and versions

Product Affected versions Fixed in
Arc 1.6 earliest → < 1.6.0 1.6.0
arc 1.6 earliest → < 1.6.0 1.6.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Arc

The 8 CVEs of Arc →
CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which… 5.3 Medium CVE-2026-33922 A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to… 6.8 Medium CVE-2026-33921 The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the… 4.8 Medium CVE-2025-40896 The server certificate was not verified when an Arc agent connected to a Guardian or CMC 6.3 Medium
Track this CVE