CVE-2024-58288CWE-428

CVE-2024-58288

published December 12, 2025

CVSS
8.7
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.1th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2025-12-12T03:15Z
References (4)
https://www.exploit-db.com/exploits/52065 · [email protected]https://www.genexus.com/en/developers/downloadcenter?data=;; · [email protected]https://www.genexus.com/es/ · [email protected]https://www.vulncheck.com/advisories/genexus-protection-server-unquoted-service-path-privilege-escalation · [email protected]
EPSS history
Timeline
  • 11 DEC 21:33Z
    Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation
    cvelistv5