CVE-2015-7378

HIGH

Panda Security URL Filtering < 4.3.1.8 - Privilege Escalation via Weak Directory ACL

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-7378. PoCs published by Kyriakos Economou.

AI-analyzed exploit summary This is a detailed writeup describing a privilege escalation vulnerability in Panda Security URL Filtering < v4.3.1.9. The issue arises from insecure ACLs on the service directory, allowing any local user to replace the executable with a malicious one, leading to SYSTEM-level code execution upon reboot.

Description

Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.

Exploits (1)

exploitdb WRITEUP

by Kyriakos Economou · textlocalwindows

https://www.exploit-db.com/exploits/39670

View Code ZIP pw:eip

This is a detailed writeup describing a privilege escalation vulnerability in Panda Security URL Filtering < v4.3.1.9. The issue arises from insecure ACLs on the service directory, allowing any local user to replace the executable with a malicious one, leading to SYSTEM-level code execution upon reboot.

Classification

Writeup 100%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: Panda Security URL Filtering < v4.3.1.9

No auth needed

Prerequisites: Local access to the affected system · Ability to modify files in C:\ProgramData\Panda Security URL Filtering

MITRE ATT&CK

T1548.002 - Bypass User Account Control T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html

Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/39670/

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2016/Apr/25

Scores

CVSS v3 7.8

EPSS 0.0085

EPSS Percentile 53.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-276

Status published

Products (1)

watchguard/panda_url_filtering < 4.3.1.8

Published Apr 18, 2016

Tracked Since Feb 18, 2026