Incorrect permission assignments in Remote Utilities Host allow local authenticated attackers to gain elevated privileges through DLL manipulation.

The application suffers from incorrect permission assignments for critical resources, specifically related to DLL file access. A local attacker with low privileges can leverage these weak permissions to replace or manipulate DLLs, leading to full system compromise.

A successful exploit allows for full system control by a low-privileged user, leading to potential data theft, installation of persistent backdoors, or lateral movement within the environment. While the CVSS score is 7.3, the impact is mitigated by the requirement for local access and high complexity.

Immediate Action: Manually remove the Everyone:(F) ACL from all DLL files within the installation directory and restrict access to SYSTEM, Administrators, and authorized Users only.

Proactive Monitoring: Monitor file integrity within the installation directory to detect any unauthorized modifications to binary or DLL files.

Compensating Controls: Implement strict endpoint security policies that limit local user ability to modify application directories or execute unsigned code.

Public Exploit Available: No confirmed public exploit.

While the requirement for local access reduces the immediate threat, the potential for total system compromise makes this a significant risk. Organizations should apply the recommended ACL restrictions immediately and monitor for future vendor patches to automate these security settings.