vendor:
Brother BRAgent
by:
Brian Rodriguez
7,8
CVSS
HIGH
Unquoted Service Path
73
CWE
Product Name: Brother BRAgent
Affected Version From: 1.38
Affected Version To: 1.38
Patch Exists: NO
Related CWE: N/A
CPE: a:brother:brother_bragent:1.38
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 10 Enterprise 64 bits
2021
Brother BRAgent 1.38 – ‘WBA_Agent_Client’ Unquoted Service Path
Brother BRAgent 1.38 is vulnerable to an unquoted service path vulnerability. This vulnerability can be exploited by an attacker to gain elevated privileges on the system. The vulnerability exists due to the service path of the Brother BRAgent service not being properly quoted. An attacker can exploit this vulnerability by creating a malicious executable with the same name as the service path and placing it in the same directory. When the service is started, the malicious executable will be executed with SYSTEM privileges.
Mitigation:
Ensure that all service paths are properly quoted. Additionally, ensure that all services are running with the least privileges necessary.
