Vulners
Lucene search
SOUND4 Server Service 4.1.102 Local Privilege Escalation
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2023-53965 | 23 Dec 202508:44 | – | circl |
 | SOUND4 Server Service 代码问题漏洞 | 22 Dec 202500:00 | – | cnnvd |
 | CVE-2023-53965 | 22 Dec 202521:35 | – | cve |
 | CVE-2023-53965 SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path | 22 Dec 202521:35 | – | cvelist |
 | EUVD-2023-60227 | 23 Dec 202500:30 | – | euvd |
 | CVE-2023-53965 | 22 Dec 202522:16 | – | nvd |
 | CVE-2023-53965 | 22 Dec 202522:16 | – | osv |
 | PT-2025-52702 | 22 Dec 202500:00 | – | ptsecurity |
 | CVE-2023-53965 SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path | 22 Dec 202521:35 | – | vulnrichment |
<html><body><p>SOUND4 Server Service 4.1.102 Local Privilege Escalation
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: 4.1.102
Summary: SOUND4 Windows Server Service.
Desc: The application suffers from an unquoted search path issue impacting
the service 'SOUND4 Server' for Windows. This could potentially allow an
authorized but non-privileged local user to execute arbitrary code with
elevated privileges on the system. A successful attempt would require the
local user to be able to insert their code in the system root path undetected
by the OS or other security applications where it could potentially be executed
during application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.
Tested on: Windows 10 Home 64 bit (build 9200)
SOUND4 Server v4.1.102
SOUND4 Remote Control v4.3.17
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5721
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php
26.09.2022
--
C:\>sc qc "SOUND4 Server"
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: SOUND4 Server
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\SOUND4\Server\SOUND4 Server.exe --service
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SOUND4 Server
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\>cacls "C:\Program Files\SOUND4\Server\SOUND4 Server.exe"
C:\Program Files\SOUND4\Server\SOUND4 Server.exe NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Administrators:(ID)F
BUILTIN\Users:(ID)R
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
C:\Program Files\SOUND4\Server>"SOUND4 Server.exe" -V
4.1.102
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Dec 2022 00:00Current
6.2Medium risk
Vulners AI Score6.2
CVSS 3.17.8 - 8.4
CVSS 48.6
EPSS0.00033
SSVC