Grandstream Wave DLL Search Order Hijacking Vulnerability Allowing Arbitrary Code Execution on Windows 11

A DLL search order hijacking vulnerability has been identified in the Wave application by Grandstream Networks, specifically in the executable wave.exe for Windows 11, version 1.27.8. This vulnerability allows local attackers to execute arbitrary code by placing a file in the 'C:\Users<user>\AppData\Local\Temp' directory. The issue could lead to unauthorized code execution and persistence. Notably, this vulnerability is only present in Windows 11 and does not affect earlier versions.

Impact

Exploitation of this vulnerability could result in arbitrary code execution with persistence on the affected system.

Remediation

Users can upgrade to Grandstream Wave version 1.27.11 to address this vulnerability.