Servereye Windows Agent Sensorhub
Monthly
Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. No public exploit identified at time of analysis; this was reported by NCSC.ch and is not listed in CISA KEV, so there is no evidence of active exploitation.
Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. No public exploit identified at time of analysis; this was reported by NCSC.ch and is not listed in CISA KEV, so there is no evidence of active exploitation.