CVE-2017-7884 – APC UPS Daemon 3.14.14 Privilege Escalation

https://notcve.org/view.php?id=CVE-2017-7884

16 Jun 2017 — In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe. En Demonio APC UPS hasta versión 3.14.14 de Adam Kropelin adk0212 , la instala... • https://packetstorm.news/files/id/142977 • CWE-427: Uncontrolled Search Path Element •