CVE-2021-47809
HighSummary
The vulnerability in Disk Sorter Enterprise 13.6.12 stems from an unquoted service path in its Windows service configuration. It allows a local attacker to inject a malicious executable into the path 'C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe' and potentially execute arbitrary code with elevated privileges.
Risk Assessment
The risk involves potential privilege escalation by a local user, which could lead to full system compromise and data integrity violation.
Recommendation
It is recommended to immediately update Disk Sorter Enterprise to the latest version that addresses this vulnerability. Additionally, review service configurations and ensure paths are properly quoted.
Other vulnerabilities in Disk Sorter Enterprise
Original NVD description (English source)
Disk Sorter Enterprise 13.6.12 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe' to inject malicious executables and escalate privileges.