PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-54353 Personifyinc CVE debrief

CVE-2023-54353 is a high-severity unquoted service path vulnerability in Chromacam 4.0.3.0's PsyFrameGrabberService. Local attackers can exploit this by placing malicious executables in unquoted path directories, allowing code execution with LocalSystem privileges at boot. The vulnerability has a CVSS score of 8.5. Affected systems include those with Chromacam 4.0.3.0 installed, particularly if attackers have write access to directories like C: or C:Program Files (x86)Personify. Defenders should prioritize patching or mitigating this vulnerability to limit exposure.

Vendor
Personifyinc
Product
Chromacam
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-23
Advisory published
2026-06-19
Advisory updated
2026-06-23

Who should care

Organizations using Chromacam 4.0.3.0 should prioritize patching or mitigating this vulnerability. Local attackers with write access to certain directories can exploit this vulnerability to execute code with elevated privileges. This vulnerability is particularly concerning for environments where attackers may already have local access or where directory permissions are not tightly controlled.

Technical summary

The PsyFrameGrabberService in Chromacam 4.0.3.0 has an unquoted service path vulnerability. This allows local attackers to execute arbitrary code by placing malicious executables in directories with unquoted paths, such as C: or C:Program Files (x86)Personify. When the PsyFrameGrabberService starts automatically at boot, it will execute the malicious file with LocalSystem privileges. The vulnerability is classified under CWE-428 (Unquoted Service Path).

Defensive priority

High priority due to local attack vector and potential for privilege escalation

Recommended defensive actions

  • Apply the vendor patch for Chromacam 4.0.3.0 if available
  • Review and correct directory permissions for PsyFrameGrabberService
  • Monitor for suspicious activity in directories used by PsyFrameGrabberService
  • Implement compensating controls to restrict write access to vulnerable directories
  • Inventory systems for Chromacam 4.0.3.0 and prioritize patching

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE records. The vulnerability affects Chromacam 4.0.3.0 and involves the PsyFrameGrabberService. Defenders should verify the installation of Chromacam 4.0.3.0 and review directory permissions for the PsyFrameGrabberService. The CVE and NVD provide official details on the vulnerability's impact and affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-54353 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-54353

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-54353 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-54353

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.