CVE-2023-39425 is a high severity (CVSS 8.8) improper access control flaw in Intel Driver and Support Assistant (DSA) before version 23.4.33. An authenticated local user could escalate privileges. Intel's advisory is INTEL-SA-00969. Update DSA to 23.4.33 or later, or remove it if unused.
What's affected
The NVD record names Intel Driver and Support Assistant, with all versions before 23.4.33 affected. The record scores it 8.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: a local attack, low complexity, low privileges, no user interaction, and a changed scope with high impact.
The weakness class is CWE-284 (improper access control). The fixed version, per the record, is 23.4.33. We could not load Intel's advisory page (it returned an access denied message), so this post relies on the NVD description. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
On a Windows machine, open Settings, then Apps, then Installed apps, and look for Intel Driver and Support Assistant. Its version should be 23.4.33 or later.
DSA is a utility that people install to keep Intel drivers current, so it is often present on laptops and workstations that nobody inventoried as running Intel software. Use your endpoint management tool to list installed software and search for the product name.
What to do now
- Search your endpoint inventory for Intel Driver and Support Assistant and note the version on each machine.
- Update to 23.4.33 or later. Intel's advisory INTEL-SA-00969 is the place to confirm the fixed version and the download.
- If you do not need DSA, remove it. A utility that is not installed cannot be attacked.
- Limit local administrator rights and the number of users who can log in to shared machines, since this flaw needs a local account.
- Check the machine again after the update to confirm the version.
Why it matters
Improper access control means a component does not restrict who may do something it should restrict. For a local utility like DSA that often runs with higher rights than the person using it, a gap in that control can let an ordinary account act with more power than intended. The record calls this potential escalation of privilege via local access.
The risk is local, so it is mostly a step in a longer attack. An intruder who gets a standard user session, perhaps through phishing, looks for a way to become administrator. Flaws in vendor support tools are a common choice because the tools are widely installed and run with elevated rights. The fix is small, and removing unused tools is smaller still.
Try it yourself
The first step with a bundled support tool is knowing where it runs. This demo shows how a dependency inventory answers that.
Click through it at your own pace, or open it full screen.
Quick check
Can this be exploited remotely?
Not directly. The record says local access and an authenticated user. An attacker needs a foothold on the machine first.
Which version fixes it?
Intel DSA 23.4.33 or later, according to the record.
Sources
- Intel advisory INTEL-SA-00969 (listed in the record; the page returned access denied for us)
- Safeguard Gold entry for CVE-2023-39425
Last reviewed: 19 October 2026.
