1&1 · 1&1 Online Storage · CVE-2019-9486
**Name of the Vulnerable Software and Affected Versions**
STRATO HiDrive Desktop Client versions 5.0.1.0
Telekom MagentaCLOUD versions through 5.7.0.0
1&1 Online Storage versions through 6.1.0.0
**Description**
The issue concerns a SYSTEM privilege escalation through the HiDriveMaintenanceService service, which establishes a NetNamedPipe endpoint. This allows applications to connect and call publicly exposed methods, enabling an attacker to inject and execute code by hijacking the insecure communications with the service.
**Recommendations**
For STRATO HiDrive Desktop Client version 5.0.1.0, consider disabling the HiDriveMaintenanceService service until a patch is available.
For Telekom MagentaCLOUD versions through 5.7.0.0, restrict access to the NetNamedPipe endpoint to minimize the risk of exploitation.
For 1&1 Online Storage versions through 6.1.0.0, avoid using the publicly exposed methods in the HiDriveMaintenanceService service until the issue is resolved.