CVE-2023-28796: IPC Bypass Through PLT Section in ELF

Description

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.

Scores

CVSS scores of CVE-2023-28796, by who scored it
Scored by	CVSS	Score	Vector
ZscalerCNA (assigner)	3.1	High7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.18% · top 92% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs
CWE-347 (opens in a new tab)All about CWE-347 and its CVEs

Affected products

Zscaler · Client Connector
- affected < 1.3.1.6

References (1)

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-28796](https://trackcve.app/badge/CVE-2023-28796.svg)](https://trackcve.app/cve/CVE-2023-28796)

Record last updated 27 Feb 2025, 20:39 UTC.