CVE-2018-17776

HIGH

PCProtect Anti-Virus <4.8.35 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-17776. PoCs published by Hashim Jawad.

AI-analyzed exploit summary This exploit demonstrates a privilege escalation vulnerability in PCProtect Anti-Virus v4.8.35 due to weak folder permissions allowing any user to replace the SecurityService.exe binary, which runs as Local System, leading to escalation to NT AUTHORITY\SYSTEM upon reboot.

Description

PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users to gain privileges by replacing an executable file with a Trojan horse.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Hashim Jawad · textlocalwindows_x86-64
https://www.exploit-db.com/exploits/45503

This exploit demonstrates a privilege escalation vulnerability in PCProtect Anti-Virus v4.8.35 due to weak folder permissions allowing any user to replace the SecurityService.exe binary, which runs as Local System, leading to escalation to NT AUTHORITY\SYSTEM upon reboot.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: PCProtect Anti-Virus v4.8.35
No auth needed
Prerequisites: Access to the system with PCProtect Anti-Virus v4.8.35 installed · Ability to replace the SecurityService.exe binary
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/149581/PCProtect-4-8.35-Privilege-Escalation.html
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45503/

Scores

CVSS v3 7.8
EPSS 0.0339
EPSS Percentile 87.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (1)
pcprotect/antivirus 4.8.35
Published Sep 28, 2018
Tracked Since Feb 18, 2026