A local buffer overflow vulnerability in Admin Express 1.2.5.485 allows an attacker to achieve arbitrary code execution on the host system.

The software contains a local structured exception handling (SEH) buffer overflow flaw in the System Compare feature. By supplying a crafted alphanumeric payload into the Folder Path field, an unauthenticated local attacker can trigger arbitrary code execution with the privileges of the application.

Successful exploitation of this vulnerability results in full system compromise for the affected host. Because the application executes with user or system privileges, an attacker can gain unauthorized access to sensitive data, install persistent malware, or move laterally within the network. With a CVSS score of 7.8, this represents a high-severity risk that could lead to significant operational disruption and data loss.

Immediate Action: There is currently no known vendor patch for this legacy software. Organizations should immediately restrict access to the application or uninstall it from all systems to eliminate the attack surface.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected spikes in application memory usage. Security teams should also audit local user accounts to ensure only authorized personnel have access to systems where this software is installed.

Compensating Controls: Since the vulnerability is local, enforce strict endpoint security policies, such as implementing Application Whitelisting (AWL) to prevent the execution of unauthorized binaries or malicious shellcode payloads.

Public Exploit Available: Yes, a published proof-of-concept exploit exists, as detailed in the Exploit Database (EDB-ID: 46805).

Given the availability of public exploit code and the lack of a vendor-provided patch, the risk posed by this vulnerability is significant. We strongly recommend identifying and removing all instances of Admin Express 1.2.5.485 from the environment. If the software is mission-critical, it must be isolated from untrusted users and restricted via host-based access controls to prevent unauthorized local execution.