EUVD-2026-33066
GHSA-96w5-xvg7-p24r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify host running SysTrack agent
-
DeliveryCraft UDP packet with Command ID 30
-
ExploitPlace invalid pointer at payload offset 0x4
-
ExecutionSend packet to agent UDP port
-
PersistTrigger out-of-bounds read in handler
-
ImpactCrash lsiagent.exe and lose endpoint telemetry
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to deliver a UDP packet to the host running lsiagent.exe on the port that handles SysTrack agent commands, with a payload formatted as Command ID 30 and an invalid memory address placed at offset 0x4 of the payload; no authentication, no user interaction, no privileges, and no non-default configuration are required (per CVSS PR:N/UI:N/AT:N and the description). The practical limiting factor is network reachability of the agent's UDP listener - in enterprises where SysTrack agents only accept traffic from designated master servers via firewall rules or VLAN isolation, exploitation requires the attacker to already be on a trusted segment or to spoof traffic from a permitted source. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and all confidentiality/integrity impacts at None) accurately describes a pure availability bug - trivially reachable over the network but limited to crashing the agent rather than code execution or data disclosure, despite the vendor-supplied tags claiming 'Buffer Overflow' and 'Information Disclosure' which are not substantiated by the description (only DoS via out-of-bounds read is described). EPSS and CISA KEV status were not provided in the input, so exploitation probability cannot be quantified and active exploitation is not confirmed. Real-world priority is moderate: in environments where SysTrack is used for security telemetry or compliance monitoring, a remote unauthenticated agent crash can blind defenders to endpoint activity, but a crashed agent typically restarts and does not lead to host compromise, so this should be treated as a monitoring-availability issue rather than a critical RCE. |
| Exploit ScenarioDerived | An attacker on the same network segment as monitored endpoints (or anywhere reachable if the agent UDP port is exposed) sends a single UDP datagram crafted as a Command ID 30 message with an invalid memory address encoded at payload offset 0x4. The lsiagent.exe process dereferences the bad pointer, takes an access violation, and terminates - knocking out SysTrack telemetry for that host and potentially being repeated across thousands of endpoints in a sweep to blind a SOC before a follow-on intrusion. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 28, 2026
Remote denial of service in Lakeside SysTrack Agent (lsiagent.exe) allows unauthenticated network attackers to crash the endpoint monitoring agent by sending a single malformed UDP packet to the Command ID 30 handler. The flaw was reported by VulnCheck and carries a CVSS 4.0 score of 8.7 reflecting high availability impact with no privileges or user interaction required; no public exploit identified at time of analysis, though VulnCheck has published an advisory describing the trigger.
Earlier versions of this analysis (2)
Remote denial-of-service in Lakeside SysTrack Agent allows unauthenticated network attackers to crash the lsiagent.exe process by sending a single malformed UDP packet to the Command ID 30 handler. The flaw stems from an out-of-bounds read triggered by an attacker-controlled memory address at offset 0x4 of the payload, affecting all agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15. No public exploit identified at time of analysis, though VulnCheck has published a detailed advisory describing the trigger conditions.
Remote denial of service in Lakeside SysTrack Agent (lsiagent.exe) allows unauthenticated attackers to crash the agent process by sending a single malformed UDP packet to the Command ID 30 handler. The flaw is an out-of-bounds read (CWE-125) triggered by an invalid memory address embedded at offset 0x4 of the UDP payload, affecting all agent builds prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the issue was reported by VulnCheck and vendor hotfixes are already published.
RemediationAI
Apply the vendor-released patch for the deployed branch by upgrading the SysTrack Agent to 11.2.1.28, 11.3.0.38, 11.4.0.24, or 11.5.0.15 (or later) as documented in the Lakeside hotfix release notes linked from documentation.lakesidesoftware.com. Where immediate patching across the fleet is not feasible, restrict inbound UDP traffic to the lsiagent.exe listening port at the host firewall or network segmentation layer so only the SysTrack master servers can reach agents - note that overly tight filtering may break legitimate command-and-control telemetry between the master and agents and should be validated against the deployment's master-server addresses. Monitoring for repeated lsiagent.exe crash events in the Windows Application log or for unexpected UDP traffic to the agent port provides additional detection coverage until patches are fully rolled out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lakeside SysTrack is a digital experience monitoring platform widely deployed across enterprise endpoints, and the affected component is the lsiagent.exe Windows agent process that listens for UDP control messages. The root cause is CWE-125 (Out-of-bounds Read): the Command ID 30 UDP packet handler dereferences a pointer constructed from attacker-controlled bytes at payload offset 0x4 without validating that the resulting address points to mapped memory, producing an access violation. Because the parsing happens in the UDP receive path before any session or authentication state is established, the crash is reachable from anyone who can route a packet to the agent's listening port.
Know when Systrack Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.
Executive ViewAI
Lakeside SysTrack Agent contains a remote denial-of-service vulnerability allowing unauthenticated attackers to crash endpoint monitoring agents with a single UDP packet, potentially blinding your organization to endpoint activity during critical security events. This directly impacts incident response capability and organizational visibility across your managed endpoint fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB