CVE-2024-1618

Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard

Published Mar 12, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe service executable with a malicious file of the same name and located in a directory that has a higher priority than the legitimate directory. Thus, when the service starts, it will run the malicious file instead of the legitimate executable, allowing the attacker to execute arbitrary code, gain unauthorized access to the compromised system or stop the service from running.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Faronics

Deep Freeze Server Standard

unaffected

Version	Status	Constraints
`0`	affected	≤ 8.30.020.4627

No data.

No data available yet.

Remediation

Vendor Solution

The vulnerability has been resolved by the Faronics team in version 8.31.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-17358	A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe service executable with a malicious file of the same name and located in a directory that has a higher priority than the legitimate directory. Thus, when the service starts, it will run the malicious file instead of the legitimate executable, allowing the attacker to execute arbitrary code, gain unauthorized access to the compromised system or stop the service from running.