An incorrect privilege assignment vulnerability in NAVER MYBOX Explorer for Windows before version 3.0.11.160 allows local authenticated attackers to achieve complete system compromise.

This vulnerability is an incorrect privilege assignment flaw (CWE-266) caused by improper privilege checks during registry manipulation, requiring low local privileges and no user interaction for successful exploitation.

A successful exploit permits a low-privileged local user to escalate privileges to NT AUTHORITY\SYSTEM, granting complete control over the affected operating system. This level of access enables data exfiltration, deployment of malware, and lateral movement across the network. The CVSS score of 7.8 reflects the severity of high confidentiality, integrity, and availability impacts for local attack vectors.

Immediate Action: Update NAVER MYBOX Explorer for Windows to version 3.0.11.160 or later.

Proactive Monitoring: Monitor system logs for anomalous registry modification patterns and unexpected process creation by standard user accounts.

Compensating Controls: Restrict local system access and enforce the principle of least privilege to limit the exposure of low-privileged accounts on endpoints.

Public Exploit Available: False

Organizations utilizing NAVER MYBOX Explorer on Windows endpoints must prioritize updating to version 3.0.11.160 or later to remediate the privilege escalation vector. Because the vulnerability allows local attackers to achieve system-level control, immediate patch deployment is strongly advised to secure endpoint environments against unauthorized administrative access.