CVE-2023-35060 is an uncontrolled search path flaw in the Intel Battery Life Diagnostic Tool, scored 6.7 Medium. An authenticated local user may escalate privileges. Intel says versions before 2.3.1 are affected, and the fix is to update to 2.3.1 or later.
What's affected
Intel's advisory INTEL-SA-00987 covers Intel Battery Life Diagnostic Tool software before version 2.3.1. The fixed version is 2.3.1. Intel scores the CVE 6.7 Medium with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, which matches the record.
The impact is escalation of privilege for an authenticated user with local access. Intel links to a download for the updated tool in the advisory.
How to check if you're exposed
This is a Windows tool. Open Settings, then Apps, and look for Intel Battery Life Diagnostic Tool and its version. If it is below 2.3.1, it is affected.
For a managed fleet, query your software inventory for the product name. Laptops from several vendors may include the tool as part of a diagnostics bundle, so search by name instead of only by hardware vendor.
What to do now
- Search your endpoint inventory for Intel Battery Life Diagnostic Tool and note each version.
- Update to 2.3.1 or later using the link in Intel's advisory, or remove the tool where it is not needed.
- Keep standard users from writing to folders that privileged software loads files from.
- Add the tool to your asset list.
- Recheck your inventory after rollout.
Why it matters
An uncontrolled search path means a program looks for a library or executable in places an ordinary user can write to. If a privileged process loads whatever it finds first, an attacker who plants a file there runs code with higher rights.
It needs a local account, which is why the score is medium. On laptops, though, a single phished user is often enough local access. Removing tools you no longer use is the cheapest fix of all.
The weakness classes involved are CWE-427 (Uncontrolled Search Path Element). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Intel and NVD agree on 6.7 Medium for this CVE. Intel names 2.3.1 as the fixed version.
Quick check
Is this remote?
No. The vector is local and needs an authenticated user.
Should I just uninstall it?
If nobody needs the tool, removing it eliminates the exposure. Otherwise update to 2.3.1 or later.
Sources
Last reviewed: 19 October 2026.
