AIRBUS PSS TETRA Connectivity Server Incorrect Default Permissions Vulnerability Allowing Privilege Abuse on Windows Server

A vulnerability exists in AIRBUS PSS TETRA Connectivity Server version 7.0, running on Windows Server operating systems, due to incorrect default file permissions. This flaw allows privilege abuse, enabling an attacker to execute arbitrary code with SYSTEM privileges. The exploitation requires tricking a user into placing a crafted file in a vulnerable directory.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with SYSTEM privileges, allowing an attacker to gain elevated rights and potentially control the affected system.

Remediation

A vulnerability fix has been developed and delivered to impacted customers.