CVE-2021-35312

Name of the Vulnerable Software and Affected Versions: CIR 2000 / Gestionale Amica Prodigy version 1.7

Description: A vulnerability was found in the Amica Prodigy's executable "RemoteBackup.Service.exe" which has incorrect permissions. This allows a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges.

Recommendations: For version 1.7, consider changing the permissions of the "RemoteBackup.Service.exe" executable to prevent local unprivileged users from replacing it with malicious files. As a temporary workaround, restrict access to the "RemoteBackup.Service.exe" executable until a patch is available.