CVE-2017-6005

Waves MaxxAudio, as installed on Dell laptops, adds a "WavesSysSvc" Windows service with File Version 1.1.6.0. This service has a vulnerability known as Unquoted Service Path. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.

CVSS v3 7.0 HIGH
CVSS v2.0 6.9 MEDIUM

7.0^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://justpentest.blogspot.in/2017/07/dell-unquoted-service-path-local.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:waves:maxxaudio:1.1.6.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-07-26 08:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-6005

Mitre link : CVE-2017-6005

CVE.ORG link : CVE-2017-6005

JSON object : View

Products Affected

waves

maxxaudio

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-6005", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2017-07-26T08:29:00.663", "references": [{"url": "http://justpentest.blogspot.in/2017/07/dell-unquoted-service-path-local.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Waves MaxxAudio, as installed on Dell laptops, adds a \"WavesSysSvc\" Windows service with File Version 1.1.6.0. This service has a vulnerability known as Unquoted Service Path. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system."}, {"lang": "es", "value": "Waves MaxxAudio, tal como es instalado en laptops Dell, agrega un servicio de Windows \"WavesSysSvc\" con la versi\u00f3n de archivo 1.1.6.0. Este servicio tiene una vulnerabilidad conocida como ruta de servicio sin entrecomillar. Esto podr\u00eda potencialmente permitir a un usuario local autorizado pero no privilegiado ejecutar c\u00f3digo arbitrario con privilegios elevados en el sistema."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:waves:maxxaudio:1.1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A825008D-B9FB-439D-92A7-A63A5779C9C6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}