VulnerabilityAnalyzed

CVE-2021-47767

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges.

HIGH 8.5EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-428
Affected: 10-strike/network inventory explorer
Source: disclosure@vulncheck.com

References

https://www.10-strike.com/Product
https://www.exploit-db.com/exploits/50494Exploit
https://www.exploit-db.com/exploits/50494Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.