Description (CNA)
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Report One / MyReport Updater | affected 0 through 2.1.1 |
CWE
CWE-269