CyberRota Analysis
AI-GeneratedRemote Utilities Host versions up to 7.7.3.0 are vulnerable due to insecure ACLs on DLL files, allowing full control to the Everyone group. This flaw enables local unprivileged attackers to replace DLLs with malicious payloads during a race condition when the service is stopped, leading to potential execution of arbitrary code with SYSTEM privileges upon service restart. Organizations using this software should prioritize remediation to mitigate the risk of local privilege escalation and system compromise.
Original NVD Description
Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this directory. The DLLs are file-locked at runtime, but a race window exists when the service is stopped (e.g. during a software update or following a crash), during which a local unprivileged attacker can replace a DLL with a malicious payload. Upon service restart, the payload executes as NT AUTHORITY\SYSTEM. The DLL confirmed as actively loaded during testing is libasset32.dll. Additional DLLs in the same directory (eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll) share identical insecure permissions.