| عنوان | Intelbras InControl 2.21.56 Unquoted Service Path via "incontrolWebcam" Service |
|---|
| الوصف | Title: Unquoted Service Path via "incontrolWebcam" service.
An "Unquoted Service Path" vulnerability has been identified in InControl software version 2.21.56. This vulnerability allows a local attacker with limited permissions on the system to execute a malicious binary with elevated privileges, potentially compromising the integrity of the system.
When downloading and installing version 2.21.56 of InControl, the following command was run to list the services configured to start automatically on the system, excluding those located in the default Windows directory:
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
This command allowed us to identify services whose executable path is not properly enclosed in quotation marks. The "incontrolWebcam" service was highlighted in the output:
sc qc "incontrolWebcam"
[SC] QueryServiceConfig ÊXITO
NOME_DO_SERVIÇO: incontrolWebcam
TIPO : 10 WIN32_OWN_PROCESS
TIPO_DE_INÍCIO : 2 AUTO_START
CONTROLE_DE_ERRO : 1 NORMAL
NOME_DO_CAMINHO_BINÁRIO : C:\Program Files (x86)\intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service.exe
GRUPO_DE_ORDEM_DE_CARREG. :
MARCA : 0
NOME_PARA_EXIBIÇÃO : Incontrol Webcam
DEPENDÊNCIAS :
NOME_DO_INÍCIO_DO_SERVIÇO : LocalSystem |
|---|
| المصدر | ⚠️ https://www.intelbras.com/pt-br/software-de-gerenciamento-de-controle-de-acesso-incontrol-web |
|---|
| المستخدم | Stux (UID 40142) |
|---|
| ارسال | 10/06/2024 02:16 PM (2 سنوات منذ) |
|---|
| الاعتدال | 17/06/2024 06:52 PM (7 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 268822 [Intelbras InControl 2.21.56 incontrolWebcam Service تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|