A critical DLL hijacking vulnerability in Evope Collector allows unprivileged local attackers to achieve full system compromise via arbitrary code execution with SYSTEM privileges.

The software fails to implement secure search path validation when loading the wtsapi32.dll library, allowing an unprivileged local attacker to place a malicious DLL in the C:\ProgramData\Evope directory. Because the Evope.Service.exe component runs with SYSTEM privileges, the malicious library is executed automatically upon service startup or system reboot.

The vulnerability carries a CVSS score of 8.4, reflecting the high risk posed by local privilege escalation to SYSTEM level. Successful exploitation grants an attacker full control over the host machine, leading to potential data exfiltration, installation of persistent backdoors, and complete compromise of the affected environment.

Immediate Action: Since a specific patch is not yet confirmed, restrict write permissions on the C:\ProgramData\Evope directory to prevent unprivileged users from placing malicious files in the search path.

Proactive Monitoring: Monitor system logs for unauthorized service restarts or unexpected DLL load events involving the Evope.Service.exe process.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) solutions to flag or block unauthorized file creation in the program data directory and alert on suspicious child processes spawned by system services.

Public Exploit Available: Yes — a technical write-up detailing the attack mechanism is available at the provided researcher reference.

The severity of this vulnerability necessitates immediate attention from IT and security teams. Administrators should prioritize restricting directory permissions to block the injection vector while awaiting formal guidance or a security update from the vendor. Failure to secure this path exposes the entire host to total compromise by any user with local access.