CVE-2023-26918

Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as…

Critical · published April 13, 2023

CVSS v3.1
9.8
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

🚨 A Trojan horse can waltz right into your system thanks to a permission mistake in Diasoft File Replication Pro 7.5.0! 🔥 Think of it like a hotel where every guest can freely swap out the room keys — instead of a keycard, an attacker simply replaces your legitimate key with one that lets them in like a VIP. 🏨 If exploited, this vulnerability allows attackers to escalate their privileges to LocalSystem, which means they can control the entire system as if they were the administrator. Imagine giving someone the ability to change everything from settings to data without your consent — absolutely devastating!

Put simply

Think of it like a hotel where every guest can freely swap out the room keys — instead of a keycard, an attacker simply replaces your legitimate key with one that lets them in like a VIP. 🏨 This flaw arises because the \%ProgramFiles\%\FileReplicationPro directory is set with overly permissive access, allowing any user to replace crucial files with malicious ones that execute with high privileges.

What to do

If exploited, this vulnerability allows attackers to escalate their privileges to LocalSystem, which means they can control the entire system as if they were the administrator. Imagine giving someone the ability to change everything from settings to data without your consent — absolutely devastating! It's crucial to limit access to the \%ProgramFiles\%\FileReplicationPro folder to authorized users only. Additionally, review and patch to the latest version as updates may address this issue and mitigate risks. You've got this! Take these steps now to protect your system and keep it safe from intruders. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.06051 · 93.4th percentile
Published
2023-04-13T00:00Z
EPSS history
Timeline
  • 13 APR 00:00Z
    Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as…
    cvelistv5