servereye Sensorhub EUVD-2026-47622

Requires an existing local standard-user account or process on a Windows host that has the servereye Sensorhub agent (version 20.15 or earlier) installed with the SE3Recovery service active as SYSTEM. The concrete prerequisite is write access to %ProgramData%\ServerEye3\update\, which the flawed default directory permissions grant to standard users; the attacker must be able to create the 'update_available' trigger file and supply a path to attacker-controlled JSON instructions plus a source file to copy. Limiting factors: exploitation is local only (no remote/network path), needs prior execution as at least a low-privileged user, and is neutralized if the agent is absent, patched, or if the update directory ACL has been hardened to deny standard-user writes.

The provided CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8 High) is internally consistent with the description: the attacker needs an existing local low-privileged foothold (AV:L, PR:L), the technique is deterministic with no user interaction (AC:L, UI:N), and success crosses a security boundary from standard user to SYSTEM (S:C) with full C/I/A impact. This is a genuine, high-confidence local privilege escalation rather than an inflated network-vector CVE: the write-overwrite-restart chain is reliable and requires no race or special timing. No EPSS score, KEV entry, or POC was supplied, so exploitation-probability signals are absent; practical risk is high wherever the agent is deployed but is gated by needing prior local access, making this a post-compromise escalation / insider-threat primitive rather than a remote entry point. No conflicting signals appear in the input; the main missing data are EPSS and an independently confirmed fix version.

A standard user, or malware confined to user privileges, on a host running the servereye agent writes a malicious JSON instruction file plus a payload and drops the 'update_available' trigger into %ProgramData%\ServerEye3\update\. The SYSTEM SE3Recovery service picks up the trigger and invokes UpdaterAction.exe, which copies the attacker's payload over a servereye service binary; on the next service restart the attacker's code runs as SYSTEM. No public exploit is identified, but the described technique is straightforward and deterministic given local access (AV:L/AC:L).