CVE-2023-38817

EPSS 0.5%◆ VulnCheck KEV

Vexday Risk Score

45Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

11 Oct 2023Published on NVD

26 Jan 2026Public PoC

Weaponization speed

838 daysto first PoC

Recommendation: Patch as soon as possible — active exploitation confirmed.

An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by Microsoft itself."

Affected products

n/a · n/a

public PoCs found — 1

vulncheckvulncheck.com/xdb/f7b4b4265efbunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://ioctl.fail/echo-ac-writeup/