A local buffer overflow vulnerability in LizardSystems LanSpy 2.0.1.159 allows local attackers to achieve arbitrary code execution.

This vulnerability is a buffer overflow (CWE-787) triggered by supplying malicious input to the scan section of the application. An unauthenticated local attacker can leverage this flaw to overwrite the SEH chain, execute egghunter shellcode, and gain unauthorized code execution.

The ability to execute arbitrary code locally on a system running LanSpy poses a severe risk to confidentiality, integrity, and availability. An attacker with local access could escalate privileges, install persistent malware, or move laterally within the network. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that requires immediate attention to prevent system compromise.

Immediate Action: Users should immediately update to the latest available version of LanSpy or discontinue use of the affected version if no patch is available from the vendor.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious process execution, particularly child processes spawned by LanSpy, and review logs for unusual crash patterns indicative of SEH exploitation.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are configured to alert on anomalous memory access or shellcode execution patterns. Restrict local access to the machine to authorized personnel only to minimize the risk of malicious payload delivery.

Public Exploit Available: Yes, a functional local exploit exists as documented in ExploitDB (EDB-ID 46018).

Given the availability of functional exploit code and the critical nature of buffer overflow vulnerabilities, this issue should be treated with high priority. Organizations should verify their current version of LanSpy and apply updates immediately. If an update is not feasible, restrict local access to the application to prevent exploitation by unauthorized local users.