CVE-2017-7884

HIGH

apcupsd < 3.14.14 - Authenticated Privilege Escalation via Executable Replacement

Title source: llm

Description

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1038707

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/99092

Mailing List, Third Party Advisory x_refsource_misc

http://seclists.org/fulldisclosure/2017/Jun/20

Scores

CVSS v3 8.4

EPSS 0.0044

EPSS Percentile 34.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-427

Status published

Products (1)

apcupsd/apc_ups_daemon < 3.14.14

Published Jun 16, 2017

Tracked Since Feb 18, 2026