A high-severity OS command injection vulnerability in tclahr UAC allows local attackers to execute arbitrary code with elevated privileges.

This vulnerability is an OS Command Injection (CWE-78) flaw triggered through the run_command.sh script. The attack vector is local, requiring no authentication, but relies on user interaction to trigger the malicious command execution.

Successful exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary code with the same privileges as the UAC process. Given the CVSS score of 7.8, this poses a significant risk to data confidentiality, integrity, and system availability, particularly in environments where UAC is run with administrative or root privileges.

Immediate Action: Update the tclahr uac package to version 3.3.0 or later to include the necessary security patches.

Proactive Monitoring: Monitor system logs for suspicious process spawning or unexpected command execution patterns associated with the UAC tool.

Compensating Controls: Restrict execution permissions for the UAC tool to authorized users only and ensure that the tool is not executed in contexts where untrusted input can be passed to its scripts.

Public Exploit Available: Unknown

The severity of this command injection vulnerability necessitates prompt action. Administrators should prioritize updating to version 3.3.0 to neutralize the risk of unauthorized system-level code execution.