An insecure file handling vulnerability in iMonitor EAM 9.63.94 allows local users to achieve full system compromise via privilege escalation.

The software installs a system service that runs with SYSTEM privileges and insecurely loads files from a user-writable directory. Any local user can place malicious binaries in C:\sysupdate, which are then executed by the service upon restart.

Successful exploitation allows a local user to escalate privileges to NT AUTHORITY\SYSTEM, granting them complete control over the affected host. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, data theft, and the installation of persistent malware, potentially impacting the confidentiality, integrity, and availability of the organization's endpoints.

Immediate Action: As no vendor patch is available, administrators should immediately restrict access to the C:\sysupdate\ directory to prevent unauthorized file creation and monitor the directory for the presence of unexpected files.

Proactive Monitoring: Security teams should audit system logs for unexpected service restarts and monitor the C:\sysupdate\ directory for unauthorized file modifications or the creation of suspicious executables.

Compensating Controls: Implement strict Endpoint Detection and Response (EDR) policies to flag or block unauthorized processes originating from the EAM installation directory or the C:\sysupdate\ path.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the security researcher's write-up referenced by the CVE record.

Due to the lack of a vendor-provided patch and the availability of technical details regarding the exploit, this vulnerability poses a significant risk to the security of affected endpoints. Administrators must treat this as a high priority and apply restrictive filesystem permissions to the vulnerable directory immediately to prevent local privilege escalation.