CVE-2023-40161 is a medium severity (CVSS 6.6) local privilege escalation flaw in Intel Unite Client software before version 4.2.35041. It needs an authenticated local user and a high complexity setup. Update to 4.2.35041 or later, as listed in Intel advisory INTEL-SA-00981.
What's affected
The record names Intel Unite Client software, with every release before 4.2.35041 affected. It scores the flaw 6.6 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H. That means local access, low privileges, high attack complexity, and a user action, with high impact on confidentiality, integrity and availability if it works.
The weakness class is CWE-284 (improper access control). The fixed version in the record is 4.2.35041, and Intel's advisory INTEL-SA-00981 is the vendor document for it.
One limit on this write-up: Intel's site refused our automated fetch of the advisory, so the versions here come from the NVD record. Read INTEL-SA-00981 before you close the ticket.
How to check if you're exposed
This is a desktop application, so check it on endpoints rather than in code repositories. On Windows, list the installed version with PowerShell and compare it with 4.2.35041.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*Intel Unite*" |
Select-Object DisplayName, DisplayVersion
You can also open Settings, then Apps, then Installed apps, and search for the product name. If you use an endpoint management tool, query its software inventory for the same name and sort by version. Include shared and room systems in the search, not only personal laptops.
What to do now
- Find every machine with Intel Unite Client software installed, using your endpoint inventory or the PowerShell query above.
- Update to 4.2.35041 or later from the vendor or the OEM support page for the machine.
- If the software is not needed, uninstall it.
- Review who has local logon rights on the affected machines, since the attack needs an authenticated local account.
- Record the advisory number INTEL-SA-00981 in your exception log if a machine cannot be updated yet.
Why it matters
Improper access control is a broad class. It means a protected action or resource can be reached by a user who should have been blocked. The record does not say which action is exposed, so the honest summary is the one NVD gives: an authenticated user may potentially enable escalation of privilege via local access.
The rating here is a little different from the other two Intel entries in the same batch: attack complexity is low rather than high, and the impact on confidentiality is none, with high impact on integrity and availability. The weakness is CWE-284.
Quick check
Can someone exploit CVE-2023-40161 from the network?
Not according to the record. The vector is local (AV:L), so the attacker needs to be logged on to the machine already and the flaw is rated as hard to trigger.
Why would a medium score still be worth fixing?
Privilege escalation bugs are a second step. They turn a low privilege foothold, such as a phished user account, into administrator rights. On shared or kiosk machines that step is easier than it sounds, so a quick update is cheap insurance.
Sources
Last reviewed: 19 October 2026.
