CyberRota Analysis
AI-GeneratedVersions 20.15 and earlier of the ServerEye client are vulnerable to local privilege escalation due to insufficient access controls on the update directory, allowing standard users to create a trigger file. This vulnerability enables attackers to execute arbitrary code with SYSTEM privileges, potentially leading to full system compromise. Organizations using this software should prioritize patching or mitigating this vulnerability to protect against unauthorized access and system integrity breaches.
Original NVD Description
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.