NAVER MYBOX Explorer EUVD-2026-28530

Requires authenticated local access to a Windows system with NAVER MYBOX Explorer installed (versions before 3.0.11.160). Attacker must have low-privileged interactive logon credentials (standard user account) with sufficient permissions to modify specific registry keys - the vulnerability exists because these registry paths lack proper access controls. Exploitation does NOT require administrator privileges or non-default configurations, making any standard user installation vulnerable. The CVSS vector PR:L (low privileges required) and AC:L (low attack complexity) indicate exploitation is straightforward once local access is achieved. No user interaction (UI:N) is required beyond the attacker's own registry manipulation actions. Attack surface is limited to Windows platforms only, as indicated by the Microsoft tag and Windows-specific NT AUTHORITY\SYSTEM privilege context.

CVSS 7.8 indicates high severity with local access vector, low attack complexity, and requires low privileges without user interaction, achieving full impact across confidentiality, integrity, and availability. However, multiple signals suggest moderate real-world urgency. EPSS score of 0.02% (4th percentile) indicates extremely low probability of exploitation observed in the wild. The vulnerability is not in CISA KEV, confirming no known active exploitation. The attack vector limitation to local access significantly reduces exposure compared to network-exploitable vulnerabilities. Primary risk scenario involves post-compromise escalation where an attacker has already gained initial foothold through phishing, supply chain compromise, or other means. Organizations should prioritize patching on endpoints where NAVER MYBOX Explorer is deployed, especially in environments where users have local interactive access, but this does not warrant emergency response like remotely exploitable system-level vulnerabilities. The vendor has released a patch (version 3.0.11.160), reducing residual risk to update deployment logistics rather than unmitigated exposure.

An attacker with limited user credentials on a Windows endpoint, potentially gained through phishing or credential theft, identifies NAVER MYBOX Explorer installation. The attacker manipulates specific registry keys associated with MYBOX Explorer services or startup configurations, injecting malicious code paths or parameters. When the MYBOX Explorer service or privileged component processes these registry entries at next service restart or scheduled execution, it runs the attacker-controlled code as NT AUTHORITY\SYSTEM, granting complete control over the Windows system including access to all user data, credential stores, and ability to disable security controls or establish persistence.