SOYAL 701Client 9.0.1 Insecure Permissions

🗓️ 18 Mar 2021 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 138 Views

SOYAL 701Client 9.0.1 Insecure Permissions. Privilege escalation vulnerability in SOYAL 701Client 9.0.1 with improper permissions, allowing authenticated users to change the executable file

Reporter	Title	Published	Views	Family All 8
CNNVD	Soyal Technology 701Client 安全漏洞	27 Apr 202100:00	–	cnnvd
CVE	CVE-2021-28269	27 Apr 202114:59	–	cve
Cvelist	CVE-2021-28269	27 Apr 202114:59	–	cvelist
EUVD	EUVD-2021-14958	7 Oct 202500:30	–	euvd
NVD	CVE-2021-28269	27 Apr 202115:15	–	nvd
OSV	CVE-2021-28269	27 Apr 202115:15	–	osv
Prion	Design/Logic Flaw	27 Apr 202115:15	–	prion
RedhatCVE	CVE-2021-28269	22 May 202520:55	–	redhatcve

<html><body><p>SOYAL 701Client 9.0.1 Insecure Permissions


Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: 9.0.1 190410
                  9.0.1 190115

Summary: 701 Client is the user interface software for the access control
system. It is used for adding and deleting tokens, setting door groups
for access, setting time zones for limiting access and monitoring ingress
and egress on a live system, among other things.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'F' flag (Full) for 'Authenticated Users'
group.

Tested on: Microsoft Windows 10 Enterprise


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5634
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php


25.01.2021

--


C:\Program Files (x86)\701Client&gt;cacls client.exe
C:\Program Files (x86)\701Client\client.exe NT AUTHORITY\Authenticated Users:F
                                            NT AUTHORITY\Authenticated Users:(ID)F
                                            NT AUTHORITY\SYSTEM:(ID)F
                                            BUILTIN\Administrators:(ID)F
                                            BUILTIN\Users:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


C:\Program Files (x86)\701Client&gt;
</p></body></html>

18 Mar 2021 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 26.5

CVSS 3.18.8

EPSS0.02421