CVE-2020-23834
HIGHReal Time Logic BarracudaDrive <6.5 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-23834. PoCs published by boku.
AI-analyzed exploit summary This exploit demonstrates a local privilege escalation (LPE) in BarracudaDrive v6.5 due to insecure folder and service permissions. A low-privilege user can replace the 'bd.exe' binary with a malicious one, which executes as 'LocalSystem' upon reboot, adding a new admin user.
Description
Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem.
Exploits (1)
This exploit demonstrates a local privilege escalation (LPE) in BarracudaDrive v6.5 due to insecure folder and service permissions. A low-privilege user can replace the 'bd.exe' binary with a malicious one, which executes as 'LocalSystem' upon reboot, adding a new admin user.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H