CVE-2023-32162

Executive Summary

CVE-2023-32162 is a local privilege escalation vulnerability in Wacom Drivers for Windows, specifically in the handling of the WacomInstallI.txt file by the PrefUtil.exe utility. The flaw arises from incorrect permission assignments on the WacomInstallI.txt file, allowing a local attacker with low-privileged code execution to escalate privileges to SYSTEM and execute arbitrary code. The vulnerability is currently unpatched, with no vendor fix, public exploit, or CISA KEV listing as of the time of this report.

Technical Analysis

The vulnerability is categorized by the CNA as an "Incorrect Permission Assignment Local Privilege Escalation Vulnerability" in Wacom Drivers for Windows. The NVD description identifies the specific flaw in the handling of the file WacomInstallI.txt by the utility PrefUtil.exe.

From a vulnerability-class perspective, CWE-732 (Incorrect Permission Assignment for Critical Resource) occurs when a software component installs or creates a file or directory with permissions that are too permissive, allowing unintended actors (e.g., low-privileged local users) to read, modify, or replace the resource. In the context of a Windows driver installation, the file WacomInstallI.txt is likely created or used during the driver setup or preference utility operations, and the default permissions on this file appear to permit write access by unprivileged users.

The attack mechanism follows a classic "write-what-where" or "file replacement" privilege escalation pattern:

1. The utility PrefUtil.exe reads from WacomInstallI.txt — likely to apply installation settings or preferences.
2. Because the file has incorrect permissions, a low-privileged user can modify or replace its contents.
3. When PrefUtil.exe processes the modified file, it executes operations based on the file's content in the context of SYSTEM (the utility presumably runs with elevated privileges, perhaps as part of a scheduled task, service, or driver installation process).
4. By crafting the content of WacomInstallI.txt, an attacker can cause PrefUtil.exe to perform actions that result in arbitrary code execution as SYSTEM.

The NVD description notes that the attacker must first obtain the ability to execute low-privileged code on the target system — meaning the attack surface is post-compromise, local, and requires an initial foothold. The CVSS score of 7.8 reflects a high severity for a local vulnerability: low attack complexity, low privileges required, no user interaction, and high confidentiality/integrity/availability impact.

There is insufficient technical detail in the description to know exactly how the file content influences execution (e.g., whether it supports command injection, DLL loading paths, or script execution). No function names, APIs, or code-level details beyond PrefUtil.exe and WacomInstallI.txt are available. The exploit was researched and disclosed as ZDI-CAN-16318 by Trend Micro's Zero Day Initiative.

Exploitation Scenarios

The attack chain for CVE-2023-32162 is inferred from the vulnerability class (incorrect file permission → privileged utility reads attacker-controlled file). No public PoC exists; the chain is described based on the NVD description and standard patterns for this vulnerability class.

Step 1: Reconnaissance / Target Identification

An attacker with low-privileged access to a Windows system first identifies whether Wacom Drivers are installed. This can be done by checking installed programs, services, or directory listings for Wacom-related paths. The attacker then locates the WacomInstallI.txt file on disk (typically under the Wacom installation directory) and checks whether they have write access to it.

Step 2: Triggering the Flaw Class

The attacker modifies or replaces the contents of WacomInstallI.txt. Because the file is world-writable (or writable by the current user) due to incorrect permission assignment, the attacker can place malicious content into it. The specific content format is unknown; at the vulnerability-class level, the attacker would craft content that causes PrefUtil.exe to perform a privileged operation of the attacker's choosing.

Step 3: Payload / Execution Method

The attacker waits for or triggers the execution of PrefUtil.exe. This may occur automatically (e.g., during driver updates, on system login, via a scheduled task, or when the preference utility is launched). When PrefUtil.exe runs, it reads the attacker-controlled WacomInstallI.txt and processes it with SYSTEM privileges. The attacker's payload is thus executed in the SYSTEM context, allowing arbitrary code execution with the highest Windows privileges.

Step 4: Post-Exploitation Impact

With SYSTEM privileges, the attacker can disable security controls, install persistent backdoors, create new administrator accounts, exfiltrate data, or move laterally across the domain if the host is domain-joined. The high integrity and confidentiality impact reflected in the CVSS score (7.8, C:H/I:H/A:H) indicates full system compromise.

No public PoC is available; the attack chain is inferred from the vulnerability class. Because the vulnerability is unpatched, any Wacom driver installation on Windows is potentially exploitable.

Impact Assessment

Severity: High — CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local attacker with low privileges can achieve full system compromise without user interaction.

Affected Systems: All Windows systems with Wacom Drivers installed, across any affected version (version data not provided). Wacom products (graphics tablets, pen displays) are widely used in design, media, engineering, and education sectors, meaning the blast radius includes creative agencies, manufacturing firms, educational institutions, and enterprises where Wacom hardware is deployed.

Business Impact:

• Complete system takeover leading to data theft (source code, intellectual property, sensitive customer data).
• Persistence mechanisms that survive reboots and evade detection.
• Potential for lateral movement if the compromised host is domain-joined — the attacker's SYSTEM token can be used to access other network resources.
• Ransomware deployment is possible given full system control.

EPSS Consideration: The EPSS score of 0.00392 (32.1% percentile) suggests that exploitation in the wild is not yet common. However, this is a low-confidence indicator since the vulnerability is unpatched; once a PoC is released, exploitation likelihood is expected to rise significantly.

Detection Guidance

Sigma Rule

title: WacomInstallI.txt Permission Modification / Tampering
id: 5f6a7b8c-9d0e-4f1a-8b2c-3d4e5f6a7b8c
status: experimental
description: Detects unauthorized modification of the WacomInstallI.txt file, which may indicate CVE-2023-32162 exploitation attempts.
author: Valters IT Security
date: 2025-01-15
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2023-32162
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\WacomInstallI.txt'
    condition: selection
level: high
falsepositives:
    - Legitimate Wacom driver updates modifying the file during installation
    - Administrators performing manual configuration

YARA Rule

rule Wacom_PrivEsc_CVE_2023_32162 {
    meta:
        author = "Valters IT Security"
        description = "Detects suspicious content or patterns in WacomInstallI.txt indicative of privilege escalation attempts"
        date = "2025-01-15"
        cve = "CVE-2023-32162"
        severity = "high"
    strings:
        $s1 = "WacomInstallI.txt" nocase
        $s2 = "PrefUtil" nocase
        $s3 = "cmd.exe /c" nocase
        $s4 = "powershell" nocase
        $s5 = "C:\\Windows\\System32" nocase
        $s6 = "whoami" nocase
        $s7 = "net user" nocase
    condition:
        ($s1 or $s2) and (any of ($s3, $s4, $s5, $s6, $s7))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-32162 - Potential Wacom Privilege Escalation Payload Exfiltration"; flow:established,to_server; content:"WacomInstallI"; http_uri; nocase; content:"PrefUtil"; http_uri; nocase; classtype:attempted-admin; sid:202332162; rev:1;)

Note: This is a network-level rule targeting scenarios where an attacker may attempt to exfiltrate the crafted payload or download additional tooling. The primary exploitation is local, so network detection is limited; host-based detection should be considered primary.

Elastic Detection

file where event.action == "modification" and file.name == "WacomInstallI.txt" and
process.name != "PrefUtil.exe"

This rule detects any process other than the legitimate PrefUtil.exe modifying the WacomInstallI.txt file. If the legitimate utility itself modifies the file during a legitimate operation, additional context such as parent process or file content hashing can be used to reduce false positives.

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog
| search EventCode=4663 Object_Name="*WacomInstallI.txt" OR EventCode=4656 Object_Name="*WacomInstallI.txt"
| search NOT (Process_Name="*PrefUtil.exe")
| table _time, host, user, Process_Name, Object_Name, Access_Mask
| sort - _time

This detects file access/change events on WacomInstallI.txt by processes other than PrefUtil.exe. Access masks of interest include write operations (e.g., 0x2 = FILE_WRITE_DATA, 0x100 = FILE_APPEND_DATA, 0x4 = FILE_ADD_FILE).

Wazuh OSSEC Rule

<group name="wacom_privesc,">
    <rule id="100321" level="10">
        <if_sid>550, 551, 552, 554, 555</if_sid>
        <field name="file">WacomInstallI\.txt</field>
        <description>Wacom CVE-2023-32162: WacomInstallI.txt modified by non-PrefUtil process</description>
        <group>privilege_escalation,</group>
    </rule>
    <rule id="100322" level="8">
        <if_sid>100321</if_sid>
        <field name="process">!PrefUtil\.exe< /field>
        <description>WacomInstallI.txt accessed by process other than PrefUtil.exe</description>
        <group>privilege_escalation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED — no patch evidence from any tracked source; vendor fix not yet released. Patch confidence: 0/4.

Immediate Mitigations:

1. Restrict file permissions manually: As an administrator, explicitly set NTFS permissions on the WacomInstallI.txt file to allow only SYSTEM and Administrators full control, removing write access for Users and Authenticated Users. This directly addresses the root cause while the vendor works on a fix.
2. Remove or rename the file: If the file is not essential for driver operation, rename or remove it to prevent exploitation. Test normal Wacom functionality after this change.
3. Monitor and alert: Deploy the detection rules provided in this report to monitor for unauthorized access to or modification of the file.
4. Least privilege enforcement: Ensure that standard users do not have unnecessary write permissions to any Wacom installation directories.
5. Inventory and risk assessment: Identify all systems running Wacom Drivers and prioritize by criticality.

Patch/Upgrade Steps:

1. Monitor Wacom's official security advisories and the ZDI advisory page (ZDI-CAN-16318) for patch availability.
2. Once a patched version is released, test and deploy in a staged rollout, prioritizing high-risk systems.
3. If a patched version becomes available, update all affected installations immediately.

Long-Term Hardening:

1. Apply the principle of least privilege across the environment — users should not run with administrative rights, reducing the impact of local privilege escalation chains.
2. Implement application whitelisting (e.g., AppLocker, WDAC) to prevent execution of unauthorized binaries.
3. Use Endpoint Detection and Response (EDR) solutions with behavioral detection capabilities to identify file tampering and privilege escalation attempts.
4. Regularly review and audit file permissions on installed drivers and third-party software.
5. Maintain a threat intelligence program to track new developments for this CVE, as the vulnerability remains unpatched and a public PoC could emerge at any time.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-32162
2. ZDI Advisory (ZDI-CAN-16318): https://www.zerodayinitiative.com/advisories/ZDI-CAN-16318/
3. Wacom Security Advisories: https://www.wacom.com/support/product-support/security
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed — monitored)
5. MITRE ATT&CK — T1068: https://attack.mitre.org/techniques/T1068/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE as of the report date. The EPSS score of 0.00392 indicates a low (but non-zero) probability of exploitation in the wild. The vulnerability remains unpatched, which increases the risk of future weaponization.