CVE-2023-32163

Executive Summary

CVE-2023-32163 is a locally exploitable privilege-escalation vulnerability in Wacom Drivers for Windows, specifically within the Tablet Service component. An attacker who can execute low-privileged code on a victim machine can leverage a symbolic-link attack to make the service create arbitrary files, ultimately gaining code execution in the context of NT AUTHORITY\SYSTEM. The vulnerability carries a CVSS score of 7.8 (HIGH), yet at the time of this report there is no public patch, no vendor update, and no confirmed in-the-wild exploitation (CISA KEV: NO; EPSS: 0.00360).

Technical Analysis

The vulnerability is classified as a Link Following Local Privilege Escalation issue. The CNA title explicitly identifies the flaw within Wacom Drivers for Windows and the vulnerable component as the Tablet Service.

Mechanism (vulnerability class): A link following (or "symbolic link") vulnerability occurs when a privileged service or process creates, writes to, or modifies files using a filesystem path that does not adequately validate the target location. An unprivileged local user can pre-create a symbolic link (symlink) or junction at a path that the service later attempts to access. Instead of operating on the intended file, the service follows the link and performs the same operation (e.g., file creation, file write, or file overwrite) on a file or directory outside the intended scope—often one the attacker does not normally have write access to.

Attack surface specifics: Beyond the vulnerability class, the NVD description provides limited implementation detail. The only known specifics are:

• The vulnerable component is the Tablet Service (no process name, executable path, or service-name string is provided in the source data).
• The attacker must first achieve execution of low-privileged code on the target host.
• The attack is performed entirely locally (no network component, no remote exploitation surface implied by the description).
• The outcome of exploitation is arbitrary code execution as SYSTEM.

Code-level explanation: The NVD description states: “By creating a symbolic link, an attacker can abuse the service to create a file.” This implies the Tablet Service performs file-creation operations at predictable or attacker-influenced paths without validating that the path is not a re-parse point (symlink/junction). The flaw is therefore a classic TOCTOU (time-of-check to time-of-use) or missing-target-validation weakness.

Sufficient technical detail for signature engineering is not available in the published data. We do not have the actual service executable name, the specific file paths it writes to, or the filename objects involved. Consequently, detection rules below align to the vulnerability class (privileged process performing suspicious file-creation/link-resolution activity) rather than to a hardcoded endpoint path or DLL name.

Exploitation Scenarios

No public PoC is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description (symbolic-link exploitation against a privileged service in Windows).

1. Reconnaissance / Target Identification (Local):
   The attacker must already have a foothold on the target system, either through a prior vulnerability (e.g., web app RCE delivering a dropper), a malicious insider, or a downloaded executable (e.g., malvertising/social engineering). The attacker enumerates readable/writable filesystem paths that are likely accessed by the Wacom Tablet Service (e.g., logs, temp dirs, driver-install directories). On a system with Wacom Drivers installed, the service runs in a SYSTEM context.

2. Triggering the Flaw (Symlink Creation):
   The attacker creates a symbolic link (using mklink via cmd, or a junction via native API) at a path that the Tablet Service is expected to create/write to during its normal operation (e.g., when a tablet device is plugged in, when the service starts, or during driver-update routines). The link points to a privileged location, such as C:\Windows\System32\ file, a service binary path, or a protected registry-hive-backed file.

3. Payload / Execution Method (Vulnerability-Class Level):
   When the Tablet Service performs its file-creation operation, the OS resolves the symlink and the service writes its controlled content to the attacker-specified destination. Common class-level payloads include:

   • Overwriting a service executable or DLL that later runs in SYSTEM context.
   • Creating a new file in a startup directory (e.g., C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp).
   • Dropping a .bat, .cmd, or executable into System32 that is executed by another scheduled service.

   Because the write is performed with SYSTEM privileges, the attacker bypasses NTFS ACL restrictions on the target directory.

4. Post-Exploitation Impact:
   The attacker gains code execution in the context of NT AUTHORITY\SYSTEM. From there they can: disable security products, create new privileged accounts, install persisted backdoors (e.g., scheduled tasks or services), harvest credentials, move laterally across the domain, and deploy ransomware. The CVSS vector implies full confidentiality, integrity, and availability impact (C:H/I:H/A:H, score 7.8).

Suitability note: Because the attack is entirely local and requires prior code execution, it is a post-exploitation privilege-escalation primitive — not a network-facing vulnerability. It is highly relevant to endpoint-detection use cases and least-privilege hardening.

Impact Assessment

Business impact: For enterprises using Wacom hardware (design departments, engineering, healthcare imaging), a compromised host escalates from user-level to full administrative control. Given that Wacom drivers are commonly deployed in design/creative workstations, these are often not subject to the same endpoint-protection rigor as servers, widening the exposure window while no patch exists.

Detection Guidance

Detection rules below target the vulnerability class (link-following file-creation by privileged service) rather than a specific artifact, since exact file paths/process names are not published. Tune these rules using your validated baselines for Wacom services.

Sigma Rule

title: Wacom Tablet Service - Suspicious File Creation via Symbolic Link
id: 6f2f3b2a-8f9c-4e5d-a3b1-0c2d4e6f8a10
status: experimental
description: >
  Detects the Wacom Tablet Service creating or writing files to privileged
  locations (System32, ProgramData\Startup, Windows directory) — potential
  link-following privilege escalation (CVE-2023-32163).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-32163
author: vartersit.com Threat Intel
date: 2025/04/01
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - '\TabService.exe'      # common Wacom service name
      - '\Wacom_TabletService.exe'
    TargetFilename|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\'
      - 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp'
    TargetFilename|contains:
      - '.dll'
      - '.exe'
      - '.bat'
      - '.sys'
  filter_main:
    Image|startswith: 'C:\Program Files\Wacom\'
    TargetFilename|startswith: 'C:\Program Files\Wacom\'
  condition: selection and not filter_main
falsepositives:
  - Legitimate Wacom driver updates writing to System32 (rare, but possible).
level: high
tags:
  - attack.privilege_escalation
  - attack.t1548
  - attack.t1574
  - cve.2023.32163

Note: The Image paths above are inferred placeholders — the actual service binary name is not published. Replace with the confirmed process name once available.

YARA Rule

rule wacom_link_following_lpe_cve_2023_32163
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects indicators of CVE-2023-32163 Wacom Tablet Service link-following LPE"
        date = "2025-04-01"
        cve = "CVE-2023-32163"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-32163"

    strings:
        $s1 = "TabletService" ascii wide nocase
        $s2 = "SYSTEM" ascii wide nocase
        $s3 = "CreateFile" ascii wide nocase
        $s4 = "mklink" ascii wide nocase
        $s5 = "\\??\\" ascii wide nocase        // NT symlink object manager prefix

    condition:
        uint16(0) == 0x5A4D and               // MZ header
        filesize < 5MB and
        ( any of ($s*) and 2 of ($s1, $s2, $s3, $s4, $s5) )
}

This rule is a crude binary probe for common strings found in a malicious helper executable that sets up link-following attacks (mklink usage, NT object-manager symlink prefix, Wacom service references). Without public payload samples, this rule requires refinement against real TTP artifacts.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2023-32163 Wacom Link Following LPE - Attempted SMB Write to Privileged Path";
    flow:to_server;
    content:"|00 03 00 00 00|"; depth:5;
    content:"|ff 53 4d 42|"; distance:0;     # SMB header
    content:"|2e 00|"; distance:0;           # SMB2 CREATE
    content:"|43 3a 5c 57 49 4e 44 4f 57 53|"; nocase;  # "C:\WINDOWS"
    content:"|53 79 73 74 65 6d 33 32|"; nocase;        # "System32"
    content:"|2e 65 78 65|"; nocase;                     # ".exe" extension
    sid:202332163; rev:1; 
    classtype:attempted-admin;
    reference:cve,2023-32163;)

Note: This network rule assumes a remote-attack scenario via SMB, which contradicts the local attack vector of the vulnerability. In practice, no Suricata signature can reliably detect this vulnerability at the network layer because the exploitation never uses network sockets. The rule above is provided for completeness and should only be considered contextually valid if attackers stage files remotely that later trigger the local flaw. CVE-2023-32163 is a purely local attack — network detection is therefore low-value.

Elastic Detection (EQL)

// EQL query to run on Windows file events or Sysmon ProcessAccess/FileCreate events
process where process_name == "TabService.exe" or process_name == "Wacom_TabletService.exe"
  and file_create where
      (file_name endswith ".exe" or file_name endswith ".dll" or file_name endswith ".bat")
  and file_path startswith ("C:\\Windows\\System32\\", "C:\\Windows\\", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog
(EventCode=4688 OR EventCode=4689) 
| where match(process_name, "(?i)(TabService|Wacom_TabletService)")
| join type=inner process_guid
    [ search index=windows sourcetype="WinEventLog:Security" EventCode=4663 
      | where match(object_name, "(?i)(System32|ProgramData|Windows\\\\System)")]
| table _time, process_name, user, object_name, action, access_mask
| eval mitre_tactic = "T1548 - Abuse Elevation Control Mechanism"
| eval cve = "CVE-2023-32163"
| eval severity = "high"

Wazuh OSSEC Rule

<group name="wacom_lpe,">
  <rule id="100321" level="12">
    <decoded>winevent</decoded>
    <field name="win.system.process_name">(?i)(TabService|Wacom_TabletService)</field>
    <description>Wacom Tablet Service process spawned — potential CVE-2023-32163 LPE attempt</description>
    <group>privilege_escalation,</group>
    <mitre>
      <id>T1548</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100322" level="14">
    <if_sid>100321</if_sid>
    <field name="win.system.eventID">^4688$</field>
    <description>Wacom Tablet Service executed a child process writing to Windows system dirs — suspicious symlink behavior</description>
    <group>wacom_lpe,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

⚠ Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, security update, or patched version has been identified from any tracked source. Treat this as a persistent zero-day until Wacom releases a fix.

1) Immediate Mitigations (no patch yet)

• Restrict local execution: Enforce application allow-listing (AppLocker / WDAC) to block unknown binaries, especially those that create symlinks (mklink) or execute from %TEMP%.
• Audit and minimize local admin rights: Ensure users run with standard (non-administrator) privileges — reduces the impact of chained vulnerabilities but does not block this CVE (it elevates from low-priv to SYSTEM).
• Configuration policy: Use GPO to disable NTFS symbolic-link creation for non-privileged users (default is restricted — verify domain policy).
• Monitor Wacom service activity: Enable Sysmon (Event IDs 1, 11, 12, 23) on endpoints with Wacom hardware, with special attention to the Tablet Service writing to System32 or Startup directories.
• Segment/isolate high-risk hosts: Workstations with Wacom tablets that are internet-facing or handling sensitive data should be isolated from lateral-movement paths (network segmentation, firewall rules).

2) Patch / Upgrade Steps

• Currently: There is no patch. Do not attempt to "mitigate" by uninstalling drivers (would break hardware functionality) unless the business impact is acceptable.
• Monitor vendor channels: Track Wacom Security & Updates and NVD (link below) for a future update. As of data collection (April 2025), no fix is available.
• Upon patch release: Apply the vendor-provided driver updates to all Windows workstations during a planned maintenance window. Re-run this threat intel report against the patched version to adjust detection rules.

3) Long-Term Hardening

• Endpoint Detection & Response: Deploy/prefer agents with file-integrity monitoring and behavioral detection for link-following attacks (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) rather than relying on signatures.
• Least-Privilege Service Accounts: If possible, run Wacom services under a least-privilege virtual account instead of SYSTEM (check vendor compatibility).
• Zero-Trust for endpoints: Treat any local user on a Wacom workstation as a potential attacker; enforce host-based firewall, micro-segmentation, and MFA for all administrative logins.
• Regular audit: Quarterly, re-run this report’s detection queries against historical logs to catch silent exploitation that may have occurred before the rule deployment.

References

1. NVD — CVE-2023-32163
   https://nvd.nist.gov/vuln/detail/CVE-2023-32163

2. Wacom Official Driver & Support Page (vendor advisory channel — monitored, no fix yet)
   https://www.wacom.com/support/product-support/drivers

3. ZDI Advisory Reference (ZDI-CAN-16857) — the CNA title references this internal ID, suggesting ZDI coordinated the disclosure. Expected advisory at:
   https://www.zerodayinitiative.com/advisories/
   (advisory not publicly available at time of writing)

4. CISA Known Exploited Vulnerabilities Catalog — specifically NOT listed (confidence that no in-the-wild exploitation has been confirmed):
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog

5. EPSS (Exploit Prediction Scoring System) — CVE-2023-32163 (score: 0.00360, 28.8th percentile):
   https://www.first.org/epss/

Threat-actor activity / in-the-wild evidence: None identified at the time of writing. No ransomware group, APT, or crimeware tool has publicly claimed usage of this specific CVE. However, the "link-following" technique is well-known in local privilege-escalation toolkits (e.g., Windows-Exploit-Suggester, PEAS, PowerUp), and exploitation against Wacom drivers could easily be folded into post-exploitation frameworks like Cobalt Strike or Metasploit without public attribution. Recommend elevated monitoring of any system with Wacom drivers for 30–60 days following initial access.

Report generated for vartersit.com — CVE-2023-32163 threat intelligence brief. All technical claims limited to the source data provided; some details (process names, file paths) are explicitly noted as inferred and must be validated before production deployment.