electerm EUVD-2026-56920

The victim must be running electerm prior to version 3.15.120 and must establish an RDP session to an attacker-controlled or compromised RDP server. The RDP server must initiate a clipboard file transfer (CLIPRDR) with a crafted filename containing path traversal sequences. User interaction is required (UI:R): the victim must actively connect to the malicious server and the file transfer must be accepted or triggered within the session. No special electerm configuration is needed beyond normal RDP connectivity. Exploitation is bounded by the need to control or compromise an RDP endpoint that the victim trusts enough to connect to; the attack cannot be initiated without that prior session establishment. Exploitation does not result in data exfiltration (C:N) - impact is limited to arbitrary file writes on the victim's filesystem.

CVSS 8.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H reflects a high-severity but user-interaction-dependent vulnerability. The AV:N and AC:L metrics confirm easy network reachability and low exploitation complexity once a connection is established; PR:N confirms the attacker needs no pre-existing privileges on the victim system. The critical limiting factor is UI:R: the victim must actively connect to the malicious RDP server and receive a file transfer, ruling out passive or spray-style attacks. The S:U (scope unchanged) and C:N (no confidentiality loss) constrain the blast radius to write-only filesystem impact, though I:H and A:H signal that overwriting system files, configuration, or executables is realistic. No CISA KEV listing and no known public POC reduce immediate urgency relative to the raw CVSS score. EPSS data was not provided in source intelligence. The realistic threat actor is one who can socially engineer a user into connecting to an attacker-controlled RDP endpoint, or who has compromised a legitimate RDP server that electerm users trust.

An attacker operates a malicious RDP server and social-engineers an electerm user into connecting (e.g., via a phishing link to a fake corporate remote-desktop endpoint). Once the session is established, the server triggers a CLIPRDR clipboard file transfer with a crafted filename such as ../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malware.exe. electerm resolves the unsanitized path and writes the attacker's payload outside the save directory, achieving persistence on next user login without any further interaction required.