Description
An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method.
References (2)
Core 2
Core References
Product x_refsource_misc
https://controlup.com
Patch, Vendor Advisory x_refsource_misc
https://www.controlup.com/security/security-advisory-local-privilege-escalation/
Scores
CVSS v3
7.8
EPSS
0.0030
EPSS Percentile
21.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (1)
controlup/real-time_agent
< 8.5 (2 CPE variants)
Published
Jan 04, 2022
Tracked Since
Feb 18, 2026