CVE-2021-44595

HighCVSS 8.8

Published: 29/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

20.56%

97th percentile - higher than 97% of all known CVEs

Summary

A vulnerability in Wondershare Dr. Fone (latest version as of 2021-12-06) is due to incorrect access control. A normal user can send manually crafted packets to the ElevationService.exe process and execute arbitrary code without validation, with SYSTEM privileges.

Risk Assessment

An attacker with low privileges can gain full system control (SYSTEM), leading to complete compromise of confidentiality, integrity, and availability of organizational data and resources.

Recommendation

Immediately update Wondershare Dr. Fone to the latest version if a patch is available, or consider temporarily disabling the ElevationService.exe service until fixes are released.

Original NVD description (English source)

Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM privileges.