A critical command injection vulnerability in UAC allows attackers to execute arbitrary commands with the privileges of the UAC process, potentially leading to full system compromise.

This is a command injection flaw (CWE-78) occurring within the _run_command() function, where attacker-controlled inputs are passed to an eval statement without sanitization. An attacker can supply malicious payloads through system files or iterator values to execute arbitrary code under the security context of the UAC process.

The vulnerability carries a CVSS score of 7.8, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to run arbitrary code, which could lead to unauthorized data exfiltration, permanent system persistence, or the modification of critical forensic logs, severely undermining the integrity of security operations.

Immediate Action: Update the UAC software to version 3.3.0-rc1 or newer to implement the necessary input sanitization fixes in the command execution pipeline.

Proactive Monitoring: Review system logs for unexpected shell metacharacters or command substitutions, particularly within processes invoking UAC, and monitor for unauthorized execution of child processes.

Compensating Controls: Restrict execution permissions for the UAC utility to only necessary service accounts and ensure that input files processed by UAC are sourced from trusted, non-writable locations.

Public Exploit Available: Unknown

Given the severity of potential command execution, organizations should prioritize upgrading their UAC deployments to version 3.3.0-rc1 immediately. Failure to patch leaves forensic collection infrastructure vulnerable to subversion, which could be leveraged to hide attacker activity during an incident response lifecycle.