CVE-2023-45736 is a medium severity insecure inherited permissions flaw in Intel Power Gadget for Windows, scored 6.7. A local authenticated user may escalate privileges. Intel is not releasing a fix, so uninstall the tool. It sits in the same Intel advisory as CVE-2023-45217.
What's affected
The NVD record says all versions of Intel Power Gadget for Windows are affected. Intel's advisory SA-01037 lists Power Gadget for Windows before 3.6.0 and for macOS before 3.7.0 across its set of CVEs, and it states that Intel is not releasing updates. The product has a Product Discontinuation Notice, and Intel recommends uninstalling it or stopping use.
The two sources differ slightly on versions, but the remedy is the same either way. The score is 6.7, medium, with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, which reads as local, high complexity, low privileges and one user action.
This is a sibling of CVE-2023-45217, which sits in the same advisory with a higher score of 8.8.
How to check if you're exposed
Search for the tool on Windows machines, starting with developer and performance test systems. A PowerShell query against the uninstall registry keys lists matches:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like "*Power Gadget*" | Select DisplayName, DisplayVersion
Any hit on Windows is in scope, because no fixed release exists to compare against.
What to do now
- Search Windows endpoints for Intel Power Gadget.
- Uninstall it, as Intel recommends.
- Check that the install folder is gone after removal, since the flaw concerns file permissions.
- Pick a supported alternative if a team needs power telemetry.
- Block reinstallation through your software control policy.
Why it matters
The weakness is insecure inherited permissions, CWE-277. When a program creates files or folders that inherit permissive access rights from a parent location, an unprivileged user may be able to change content that a privileged process later uses. That is how a local user can climb to higher rights.
The score is medium because the attack is complex and needs a user action. That does not change the guidance, since the product will not receive a fix.
The CVE is not on the CISA KEV list, and the Intel advisory does not report exploitation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Is this the same as CVE-2023-45217?
They share an advisory and a product. The weakness differs: this one is about inherited permissions and has a lower score.
Is a patch coming?
Intel says no. The product is discontinued.
Sources
Last reviewed: 19 October 2026.
