CVE-2025-6723: progress software chef inspec Improper Privilege Management
Vulnerability summary
CVE-2025-6723 is a medium (CVSS 5.8) Improper Privilege Management vulnerability in progress software chef inspec. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.
Timeline
- 30-01-2026PublishedVulnerability first disclosed.
- 11-03-2026Last modifiedVulnerability information updated.
Description
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption. This issue affects Chef Inspec: through 5.23 and before 7.0.107
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.01 pp
From 0.13% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Progress software1 product
- chef inspec≤ <=5.23, <7.0.107
1 vendor · 1 product