Multiple security flaws in the servereye Windows Agent allow a local, authenticated attacker to escalate privileges and compromise system integrity.

The agent is susceptible to insecure temporary file creation (CWE-379), improper privilege management (CWE-269), and path manipulation (CWE-73). These vulnerabilities allow a low-privileged local user to manipulate the service environment and escalate their privileges on the host system.

An attacker who has already gained low-level access to the host machine can leverage these flaws to achieve full system control. With a CVSS score of 8.8, the ability to escalate privileges poses a critical risk to the overall security of the server, potentially leading to unauthorized data access, persistence, and total system compromise.

Immediate Action: Update the servereye Windows Agent to version 20.16 or higher to resolve the privilege management and file permission issues.

Proactive Monitoring: Review system logs for unauthorized attempts to modify service configurations or access restricted directories associated with the sensorhub service.

Compensating Controls: Restrict local user access to the server and ensure that the principle of least privilege is strictly enforced for all service accounts.

Public Exploit Available: No

The risk of local privilege escalation requires urgent attention. System administrators should deploy the vendor-supplied update to version 20.16 as soon as possible to mitigate the risk of local attacks.