CVE-2024-58288

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2025-12-11

Updated

2026-07-28

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52065

References

• CVE Record
• NVD entry

Related

• CVE-2024-58287
• CVE-2024-58289
• CVE-2024-58286
• CVE-2024-5829
• CVE-2024-58285
• CVE-2024-58290