EUVD-2026-37682Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Local low-priv user invokes a SYSTEM-owned named-pipe service with no auth checks, gaining arbitrary file write/delete and thus full host compromise (C/I/A:H).
Primary rating from Vendor (SEC-VLab).
CVSS VectorVendor: SEC-VLab
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
1DescriptionCVE.org
Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.
AnalysisAI
Local privilege escalation in Quanos SCHEMA ST4 on-premises allows low-privileged authenticated Windows users to obtain SYSTEM-level code execution by abusing the Client Update Service. The service exposes a .NET Remoting endpoint over a named pipe with missing authorization checks (CWE-862), letting any local user invoke privileged Update() methods that perform arbitrary file write/delete as NT AUTHORITY\SYSTEM. No public exploit identified at time of analysis, but technical details were disclosed by SEC Consult (SEC-VLab).
Technical ContextAI
Quanos SCHEMA ST4 is a component content management system (CCMS) used for technical documentation in regulated industries; the on-premises variant ships a Windows Client Update Service running as SYSTEM. That service implements its IPC using legacy .NET Remoting bound to a named pipe channel - a Microsoft technology that, by default, does not perform caller authentication or authorization unless the developer explicitly configures secure channels and IAuthorizeRemotingConnection sinks. The root cause maps to CWE-862 (Missing Authorization): the Update() and related remote methods are reachable by any local interactive user because the named-pipe ACL and Remoting sink permit Everyone/Authenticated Users to bind and invoke methods. Because the server process holds SYSTEM, file operations it performs inherit that token, giving the caller a primitive for arbitrary write/delete on protected paths. CPE cpe:2.3:a:quanos_solutions_gmbh:schema_st4:*:*:*:* indicates all unspecified versions of the on-prem product are in scope until Quanos publishes a fixed build.
RemediationAI
Patch status is unclear from the supplied data, so treat this as: no vendor-released patch independently confirmed at time of analysis - check the SEC Consult coordinated-disclosure advisory at https://r.sec-consult.com/quanos and the Quanos customer portal for a fixed Client Update Service build and apply it as soon as available. Until a patched build is installed, compensating controls are: stop and disable the SCHEMA ST4 Client Update Service on multi-user hosts (trade-off: clients will no longer auto-update and must be patched manually); restrict the named-pipe ACL so only the Administrators group and the service account can open the pipe (trade-off: requires custom security descriptor and may be reverted by reinstall); block interactive logon for non-administrative users on machines running the service via Group Policy (trade-off: not viable on shared author workstations); and monitor for unexpected child processes or file writes performed by the update service into system directories.
More in Schema St4
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today