pcvisit Remote Host CVE-2026-0539

Requires authenticated local access to Windows system with pcvisit Remote Host Modul installed (PR:L in CVSS vector). Attacker must have a low-privileged user account capable of writing to the pcvisit service binary file location. Exploitation succeeds only if the service binary file permissions allow modification by non-privileged users (the default misconfiguration in affected versions). System reboot is required to trigger service execution with elevated privileges, though attackers with local access can force reboot. No specific Windows version, pcvisit feature, or non-default configuration required - vulnerability exists in default installations. Limited by local-only attack vector (AV:L) - attacker must already have command execution on the target system through other means (RDP, stolen credentials, initial malware infection).

Real-world risk is HIGH for organizations with pcvisit deployed in multi-user Windows environments. CVSS 4.0 score of 8.5 reflects maximum local impact (VC:H/VI:H/VA:H) with low attack complexity (AC:L) and no user interaction required (UI:N). The attack requires only low-privileged local access (PR:L), meaning any authenticated user including compromised accounts or malicious insiders can exploit this. No CISA KEV listing or EPSS data provided suggests this is not yet widely exploited in the wild, but the technical barrier is minimal - any user with file system access can overwrite the binary. The automatic boot-time execution (no timing window required) and guaranteed SYSTEM privileges make this highly reliable for attackers. Primary risk scenarios: lateral movement after initial compromise, insider threats, and persistence mechanisms. The local-only attack vector (AV:L) limits internet-scale exploitation but makes this critical for environments where adversaries have already gained initial access through phishing, stolen credentials, or other vectors. InfoGuard Labs' public advisory increases likelihood of copycat exploitation.

A low-privileged attacker (standard Windows user account) who has already gained local access through phishing or credential theft navigates to the pcvisit service binary installation directory. Due to weak NTFS permissions, they successfully overwrite the legitimate pcvisit service executable with a malicious binary containing a reverse shell or credential dumper. When the Windows system reboots (naturally or via forced reboot using shutdown command), the Windows Service Control Manager automatically launches the attacker's malicious binary with NT AUTHORITY\SYSTEM privileges, granting complete control over the endpoint. The attacker can then disable security software, access all files, dump credentials from LSASS, and pivot to additional network resources.