The AVACAST software by eMPIA Technology is vulnerable to a DLL hijacking flaw that enables local, authenticated attackers to escalate privileges to the system level.

This vulnerability, categorized as CWE-427 (Uncontrolled Search Path Element), occurs because the application improperly searches for required dynamic link libraries. An authenticated local attacker can place a crafted DLL into a specific directory, which the application then loads to execute code with system-level permissions.

Successful exploitation of this vulnerability results in a full compromise of the affected host, as the attacker gains system-level execution capabilities. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to unauthorized data access, persistence within the environment, and the potential for lateral movement across the network.

Immediate Action: Update the AVACAST software to version 5.10.10.45 or later to resolve the search path vulnerability.

Proactive Monitoring: Monitor system logs for unauthorized file creation or modifications in application installation directories and unusual process execution patterns.

Compensating Controls: Restrict local user permissions to prevent unauthorized file writes in application directories and employ endpoint detection and response tools to identify unauthorized library loading.

Public Exploit Available: Unknown.

This vulnerability presents a clear path for local privilege escalation and full system compromise. Organizations utilizing AVACAST should prioritize the upgrade to version 5.10.10.45 immediately to eliminate the risk of DLL hijacking. If an immediate update is not feasible, restrict local access to the application directories to prevent the placement of malicious files.