Andrew Oliveau

**Name of the Vulnerable Software and Affected Versions** Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows **Description** The issue is a local privilege escalation vulnerability that allows attackers to gain SYSTEM level access. This flaw is present in the SysTrack LsiAgent Installer for Windows, which can be exploited by low-privilege users to execute arbitrary code. The vulnerability was discovered and reported by Mandiant, and it is related to flaws in the MSI repair process. **Recommendations** For Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows, update to version 11.0 to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable installer until a patch is applied. Ensure your systems are updated to the latest version to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AutomationManager.AgentService.exe versions prior to 2.91.0.0 **Description** The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:ProgramDataN-Able TechnologiesAutomationManagerTemp, which could be leveraged by an attacker to manipulate the process into performing arbitrary file deletions. **Recommendations** For versions prior to 2.91.0.0, upgrade to version 2.91.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the Temp directory at C:ProgramDataN-Able TechnologiesAutomationManagerTemp to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JumpCloud Agent versions prior to 1.178.0 **Description** The issue allows privilege escalation to SYSTEM via a repair action in the installer. This is due to the creation of a temporary file in a directory with insecure permissions. **Recommendations** For versions prior to 1.178.0, update to version 1.178.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory where the file is created to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Splashtop Software Updater (affected versions not specified) **Description** The issue concerns the creation of a folder at C:WindowsTemp~nsu.tmp by the C:Program Files (x86)SplashtopSplashtop Software Updateruninst.exe process, which copies itself to this folder as Au .exe. This Au .exe file is launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:WindowsTemp~nsu.tmp folder inherits permissions from C:WindowsTemp and Au .exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows DPAPI (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface in the Windows DPAPI component. This can allow a remote attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Atera (affected versions not specified) **Description** The issue arises from the C:WindowsTempAgent.Package.AvailabilityAgent.Package.Availability.exe file being automatically launched as SYSTEM when the system reboots. Since the C:WindowsTempAgent.Package.Availability folder inherits permissions from C:WindowsTemp and Agent.Package.Availability.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Atera Agent versions 1.8.3.6 and earlier **Description** The issue is related to the creation of a temporary file in a directory with insecure permissions. This occurs in Atera Agent on Windows. **Recommendations** For Atera Agent versions 1.8.3.6 and earlier, update to a version later than 1.8.3.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Atera Agent versions 1.8.4.4 and prior **Description** A privilege escalation issue was discovered due to the mishandling of privileged APIs. This issue affects Atera Agent on Windows. **Recommendations** For Atera Agent versions 1.8.4.4 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** N-able Take Control Agent versions 7.0.41.1141 through 7.0.42 **Description** The issue is related to a Time-of-Check to Time-of-Use (TOCTOU) race condition in the BASupSrvcUpdater.exe service, which can be exploited via a pseudo-symlink at %PROGRAMDATA%GetSupportService N-CentralPushUpdates. This can lead to arbitrary file deletion. The vulnerability may allow an attacker to gain access to read, modify, or delete files. **Recommendations** For versions 7.0.41.1141 through 7.0.42, update to version 7.0.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the %PROGRAMDATA%GetSupportService N-CentralPushUpdates directory to minimize the risk of exploitation.