CivetWeb CVE-2026-5789

Requires three specific prerequisites: (1) CivetWeb v1.16 installed as a Windows service with unquoted path in HKLM\SYSTEM\CurrentControlSet\Services registry (specifically the path 'C:\Program Files\CivetWeb\CivetWeb.exe' without surrounding quotes), (2) Attacker possesses valid local user credentials (PR:L - low privileges sufficient per CVSS) on the Windows system, and (3) Critically, attacker must have write permissions to C:\ root directory or C:\Program Files\ directory to place malicious executables - this typically requires Administrator rights or misconfigured filesystem ACLs, creating a privilege escalation paradox. Additionally, exploitation trigger requires either system reboot or manual service restart to invoke the malicious executable. Limiting factors include: default Windows directory permissions block non-admin writes to system paths, AppLocker or Windows Defender Application Control may prevent unsigned executable execution, and modern Windows Defender flags known unquoted path exploitation patterns. Not exploitable on Linux/POSIX systems or CivetWeb deployments run as standalone applications rather than Windows services.

Real-world risk is MODERATE despite the high CVSS 8.5 score. The CVSS vector (AV:L/AC:L/PR:L) confirms this is local-only exploitation requiring low-privileged user authentication - not remotely exploitable. Attack complexity is low once local access is achieved, but critical limiting factors significantly reduce practical risk: (1) Attacker must already have local user credentials, (2) User must have write permissions to C:\ or C:\Program Files\ directories (typically restricted to administrators in default Windows configurations), (3) Service restart or system reboot required to trigger exploitation. This creates a chicken-and-egg scenario where attackers often need near-administrative rights to create the malicious executable in the first place, limiting value as a privilege escalation vector. EPSS data not provided, but similar unquoted path vulnerabilities typically show low exploitation probability due to these prerequisites. No CISA KEV listing indicates no confirmed active exploitation. Primary risk exists in enterprise environments with: relaxed filesystem ACLs, local attackers with existing foothold, or as a secondary persistence mechanism after initial compromise. For most organizations, this is lower priority than network-accessible vulnerabilities.

An attacker with low-privileged local user credentials on a Windows system running CivetWeb v1.16 as a service identifies the unquoted service path via registry inspection or automated privilege escalation scanners. In an enterprise environment with relaxed ACLs or through a separate ACL bypass vulnerability, the attacker writes a malicious executable to C:\Program.exe (or C:\Program Files\CivetWeb.exe if only C:\ is protected). Upon next system reboot or manual service restart, Windows Service Control Manager executes the attacker's malicious Program.exe with SYSTEM privileges instead of the legitimate CivetWeb.exe, granting full system control for persistence, lateral movement, or data exfiltration.