CVE-2023-36631: Circumventing Windows Firewall controls with... Malwarebytes' Windows Firewall Control

What it is

CVE-2023-36631, a missing-access-control flaw in Binisoft/Malwarebytes' Windows Firewall Control (the wfc.exe GUI backed by the privileged wfcs.exe service). Any local unprivileged user can perform privileged Windows Defender Firewall actions the native MMC snap-in restricts to the local/network administrator groups.

How it works

wfc.exe runs in the system tray for any local user who launches it from the install folder. For privileged operations it sends commands to the wfcs.exe service, which does not verify the caller's privilege level. Via Main Panel > Rules, an unprivileged user can therefore:

• Export current firewall rules (leaks the ruleset to an attacker).
• Import rules from a file (overwrite existing rules, whitelist any flow, fully bypass the firewall).
• Reset rules to Windows defaults (bypasses custom rules added after defaults).

Effectively, full firewall control without any UAC/admin gate — no exploit code needed, just GUI clicks.

Preconditions / Affected

• Windows Firewall Control installed (Binisoft/Malwarebytes).
• The interactive unprivileged user must be able to launch wfc.exe.
• The application's optional lock password must not be set — and the author confirms no lock password is prompted during a default installation, so a fresh install is vulnerable out of the box.

What to do

The page gives no patch. The only stated mitigation is the vendor's own lock-password feature, which an administrator must enable manually after install (it is not configured by default). Given the vendor's stance below, treat this as the sole control the product offers, and verify it is set on every deployment.

Caveats

• Malwarebytes disputes this as a vulnerability: the HackerOne report (#2000375) was closed twice as "informative" / "no security impact," with the final reason "it appears this is intended behavior as the application can be locked using a password," then locked. The author notes the report is unlikely to be publicly disclosed.
• CVE was assigned externally (25-06-2023) after the report was locked (21-06-2023), not by the vendor.
• This is the second access-control gap reported in the same product: CVE-2022-25150 covered the Tools tab (before v6.8.1.0) and allowed local privilege escalation — suggesting a recurring design pattern rather than a one-off.

flowchart TD
    U[Unprivileged local user] --> W[wfc.exe GUI]
    W -->|no privilege check| S[wfcs.exe privileged service]
    S --> A[Export / Import / Reset firewall rules]
    P{Lock password set?} -.blocks.-> W
    P -->|default install: NO| U

The diagram shows where the single missing check (a set lock password) would cut the chain — the whole issue turns on wfcs.exe trusting wfc.exe without verifying the caller.