CVE-2026-108072 in Remote Access
Summary
by MITRE • 10/15/2026
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical misconfiguration of file system permissions within TSplus Remote Access, specifically targeting shared login scripts located in the autostart1.tscr files found in the shared themes directory. This flaw stems from an improper assignment of access control lists that permit users with insufficient privileges to write to these configuration files. In a typical terminal server or remote desktop services environment, login scripts are executed within the security context of the user logging in, granting them elevated rights relative to their standard interactive session. When attackers can modify these scripts prior to execution, they effectively inject malicious code into the authentication flow, allowing for arbitrary command execution under the guise of legitimate system operations.
From a technical perspective, this issue represents a classic case of insecure default permissions leading to unauthorized modification of critical system resources. The attacker requires only a valid session on the terminal or remote desktop server, which significantly lowers the barrier to entry compared to vulnerabilities requiring network exposure or unauthenticated access. Once inside the environment, the adversary can edit the autostart1.tscr files to include commands that execute arbitrary payloads. Because these scripts run during the login process of other users who utilize the same theme or operating mode, the impact is not limited to the attacker's own session but extends to any subsequent user logging in with compatible settings. This mechanism facilitates persistent access and broadens the scope of potential compromise across multiple accounts within the infrastructure.
The operational impact of this vulnerability is severe, primarily due to its role as an enabler for lateral movement and privilege escalation. If a standard user exploits this flaw by injecting commands that target administrative credentials or escalate their own privileges, they can gain control over higher-privileged accounts. This capability allows attackers to move laterally across the network with greater ease, bypassing traditional perimeter defenses that rely on strict segmentation between low-level users and administrators. The ability to execute code in another user's security context means that even if initial access is gained through a compromised workstation or service account, the attacker can pivot to more sensitive systems by manipulating login scripts for high-privilege accounts.
This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, as it involves granting write permissions to entities that should not have them on files critical to system integrity and security policy enforcement. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, where attackers use scripts like those found in autostart1.tscr to execute malicious commands. It also relates to T1078 Valid Accounts, as exploitation relies on having a legitimate session, and potentially T1021 Remote Services if the attacker uses these gained privileges to access other systems remotely. The scenario exemplifies how local privilege escalation can lead to broader network compromise when proper segregation of duties and file permissions are not enforced in shared computing environments.
Mitigation strategies must focus on correcting the underlying permission settings immediately. Administrators should audit the security descriptors for all autostart1.tscr files within the TSplus themes directory and ensure that write access is restricted exclusively to administrators or system accounts responsible for managing these configurations. Regular auditing of file permissions across shared directories is essential to prevent similar misconfigurations from occurring elsewhere in the environment. Additionally, implementing strict application whitelisting can help detect unauthorized modifications to login scripts by monitoring changes to known executable paths and script files. Organizations should also consider disabling unnecessary auto-start features if they are not actively used, thereby reducing the attack surface available for such exploitation techniques.