CVE-2018-18435

KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as "Localsystem", this will allow any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a malicious one.

CVSS v3.0

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.38% chance of exploitation in the next 30 days, 70th percentile

Published

2019-03-17

Updated

2024-08-05

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/151031/KioWare-Server-4.9.6-Privilege-Escalation.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46093

References

• CVE Record
• NVD entry

Related

• CVE-2018-18428
• CVE-2018-18436
• CVE-2018-18420
• CVE-2018-18437
• CVE-2018-18419
• CVE-2018-18441