Fuji Electric Monitouch V-SFT Insecure Configuration Privilege Escalation Vulnerability

2017-08-10T00:00:00
ID ZDI-17-646
Type zdi
Reporter Fritz Sands of the Zero Day Initiative
Modified 2017-08-11T00:00:00

Description

This vulnerability allows local attackers to escalate their privileges on vulnerable installations of Fuji Electric Monitouch V-SFT. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of Monitouch V-SFT. The software is installed with weak access controls on the executable files. An attacker can leverage this vulnerability to execute code in the context of any user of the software.