dormakaba Kaba exos 9300 Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability exists in the dormakaba Kaba exos 9300 System management application (d9sysdef.exe). The vulnerability allows users to specify an arbitrary executable to be run with SYSTEM privileges, scheduled for execution at a chosen time and day of the week.

Impact

Exploitation of this vulnerability allows for local privilege escalation, where a user can execute arbitrary code with SYSTEM privileges on the Windows server running Kaba exos 9300.

Reproduction

To reproduce this vulnerability, access the 'Automatic program starts' feature in the Kaba exos 9300 System management application. Specify a path to an executable file, along with the desired start time and weekday for execution. Once scheduled, the application will run the specified executable as a background process with SYSTEM privileges.

Remediation

Users are advised to update to Kaba exos 9300 version 4.4.1 or later, where this vulnerability has been addressed.