An untrusted search path vulnerability in Zucchetti FirmaCheck allows local attackers to perform DLL hijacking and gain unauthorized code execution.

This vulnerability is a classic untrusted search path issue (CWE-426) where the application improperly validates the path used to load libraries. An authenticated local attacker can leverage this flaw to execute arbitrary code with the privileges of the application.

Exploitation of this vulnerability allows a local user to escalate privileges or execute malicious code within the context of the FirmaCheck application. With a CVSS score of 7.8, this poses a significant risk to the integrity and security of local workstations, potentially facilitating further attacks on the internal network.

Immediate Action: Update FirmaCheck to version 1.3.16 or later to ensure proper validation of library search paths.

Proactive Monitoring: Review system logs for unauthorized file access or the loading of unsigned DLLs by the FirmaCheck process.

Compensating Controls: Restrict local user permissions to write to application directories and use Endpoint Detection and Response (EDR) tools to identify suspicious process execution patterns.

Public Exploit Available: No

Organizations utilizing FirmaCheck on Windows workstations must prioritize this update to prevent local privilege escalation. Administrators should verify the installation of version 1.3.16 across all endpoints to mitigate this high-severity risk.