Catchpulse
Monthly
Local privilege escalation in SecureAge CatchPulse endpoint protection (versions up to and including 10.9.3) stems from a heap-based buffer overflow in the kernel driver saappctl.sys, where an authenticated local user can corrupt kernel heap memory to gain code execution at ring 0. Publicly available exploit code exists (demonstrated in a YouTube proof-of-concept), but there is no public exploit identified as being used in active attacks and the issue is not on CISA KEV. The CVSS 4.0 base score of 7.1 reflects local-only reachability but full compromise of confidentiality, integrity, and availability on the host once triggered.
Information disclosure in SecureAge CatchPulse (versions up to 10.9.1) is triggered through an improperly secured IOCTL handler within the saappctl.sys kernel-mode driver, allowing a low-privileged local user to extract sensitive data from the driver's memory space. A public proof-of-concept exploit exists per VulDB reporting, increasing the likelihood of opportunistic local use - particularly as a reconnaissance step within a broader privilege escalation chain. No vendor patch has been issued and the vendor did not respond to coordinated disclosure, leaving all installations of affected versions unmitigated.
Local privilege escalation in SecureAge CatchPulse endpoint protection (versions up to and including 10.9.3) stems from a heap-based buffer overflow in the kernel driver saappctl.sys, where an authenticated local user can corrupt kernel heap memory to gain code execution at ring 0. Publicly available exploit code exists (demonstrated in a YouTube proof-of-concept), but there is no public exploit identified as being used in active attacks and the issue is not on CISA KEV. The CVSS 4.0 base score of 7.1 reflects local-only reachability but full compromise of confidentiality, integrity, and availability on the host once triggered.
Information disclosure in SecureAge CatchPulse (versions up to 10.9.1) is triggered through an improperly secured IOCTL handler within the saappctl.sys kernel-mode driver, allowing a low-privileged local user to extract sensitive data from the driver's memory space. A public proof-of-concept exploit exists per VulDB reporting, increasing the likelihood of opportunistic local use - particularly as a reconnaissance step within a broader privilege escalation chain. No vendor patch has been issued and the vendor did not respond to coordinated disclosure, leaving all installations of affected versions unmitigated.