Pallet Control EUVD-2026-70977

Exploitation requires an authenticated local user session on the Windows host running Pallet Control, consistent with CVSS PR:L. The root condition is that the installer sets overly permissive default permissions on its directories, meaning the flaw is present in all installations without manual hardening regardless of configuration choices made by the operator. Exploitation is limited to local attack vectors only - remote unauthenticated exploitation is not possible. Factors that limit exploitation: the attacker must already have a valid local account on the affected host; a service restart or scheduled execution event must occur after the malicious file is placed (though an attacker may be able to trigger this); and detection by endpoint security tools monitoring file writes to program directories may interrupt the attack.

The CVSS 4.0 score of 8.5 with AV:L/AC:L/PR:L/UI:N reflects a straightforward local privilege escalation: any user with a valid local session can exploit misconfigured permissions without needing administrator rights, special timing, or target interaction. There is no KEV listing and no known public POC, and EPSS data is not available in the provided intelligence; the real-world exploitation probability at scale is therefore uncertain but not assessed as imminent. Risk is constrained by the local attack vector - an attacker must first have an authenticated foothold on the host, limiting the threat primarily to insiders, compromised service accounts, or post-exploitation scenarios following initial access by another means. Even a mid-sized municipal IT team in tczew operating shared Pallet Control workstations or terminal servers should treat this as urgent, since a single low-privileged compromise could immediately escalate to full SYSTEM control over a logistics-critical host. The absence of version constraints in the CPE wildcard suggests all deployed versions are affected until patched.

An attacker with a low-privileged local account - such as a warehouse operator workstation user or a compromised service account - identifies a world-writable subdirectory within the Pallet Control installation path containing a DLL or executable invoked by a SYSTEM-privileged service. The attacker replaces or shadows the binary with a malicious payload, then waits for the Pallet Control service to restart (or triggers a restart via legitimate application functionality), causing the payload to execute as SYSTEM and granting full control of the host. No public POC has been identified, but the technique is well-understood and requires no specialized tooling beyond file write access.