An authenticated local privilege escalation vulnerability in Wowza Streaming Engine 4.5.0 allows attackers to gain LocalSystem privileges by replacing executable service binaries.

The application utilizes insecure file permissions that grant the Everyone group full access to critical service binaries including nssm_x64.exe. An authenticated user can replace these binaries with malicious code, which will be executed with LocalSystem privileges upon service restart.

Successful exploitation of this vulnerability allows an attacker to elevate their privileges from a standard user to LocalSystem, which is the highest level of administrative access on a Windows host. This provides total control over the server, potentially leading to full system compromise, exfiltration of sensitive video content, or the deployment of persistent malicious software. Given the CVSS score of 7.8, this flaw represents a significant risk to the integrity and confidentiality of the streaming infrastructure.

Immediate Action: Update to the latest supported version of Wowza Streaming Engine and ensure file permissions on all service directories are restricted to administrative accounts only.

Proactive Monitoring: Review Windows system and service logs for unexpected service restarts or unauthorized modifications to executable files within the Wowza installation directories.

Compensating Controls: Apply strict Principle of Least Privilege policies to Windows service accounts and verify that the Everyone group does not possess write or execute permissions on application binary paths.

Public Exploit Available: Yes, a published proof of concept exists, attributed to the research writeup on Exploit-DB (EDB-ID: 40132).

This vulnerability presents a high risk due to the potential for full system takeover via local privilege escalation. Administrators should prioritize verifying file permissions on their streaming servers and ensure that the software is updated to a version where these directory permissions have been hardened. Immediate remediation is necessary to prevent local users from attaining full administrative control over the underlying host.