Myreport Updater
Monthly
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.