TightRope Media Carousel Digital Signage 7.0.4.104 C:\TRMS\Services privileges management

Summaryinfo

A vulnerability identified as critical has been detected in TightRope Media Carousel Digital Signage 7.0.4.104. This affects an unknown function of the file C:\TRMS\Services. Performing a manipulation results in privileges management. This vulnerability is known as CVE-2018-18931. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in TightRope Media Carousel Digital Signage 7.0.4.104. This affects some unknown functionality of the file C:\TRMS\Services. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the Carousel.Service.exe file with a custom malicious executable. This service is independent of the associated IIS web site, which means that this service can be manipulated by an attacker without losing access to vulnerabilities in the web interface (which would potentially be used in conjunction with this attack, to control the service). Once the attacker has replaced Carousel.Service.exe, the server can be restarted using the command "shutdown -r -t 0" from a web shell, causing the system to reboot and launching the malicious Carousel.Service.exe as SYSTEM on startup. If this malicious Carousel.Service.exe is configured to launch a reverse shell back to the attacker, then upon reboot the attacker will have a fully privileged remote command-line environment to manipulate the system further.

The weakness was published 10/29/2019. This vulnerability is uniquely identified as CVE-2018-18931 since 11/04/2018. An attack has to be approached locally. A authentication is required for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-144404. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• TightRope Media Carousel

Name

• Digital Signage

Version

• 7.0.4.104

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion