CVE-2021-40396CWE-276

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7

High · published January 28, 2022

CVSS v3.0
8.8
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2022-01-28T19:09Z
EPSS history
Timeline
  • 28 JAN 19:09Z
    A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7
    cvelistv5