Usmarine2141

**Name of the Vulnerable Software and Affected Versions** Panini Everest Engine version 2.0.4 **Description** The issue allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%Panini folder, leading to privilege escalation. A service running as SYSTEM uses the unquoted path of %PROGRAMDATA%PaniniEverest EngineEverestEngine.exe, which may result in the execution of a Trojan horse %PROGRAMDATA%PaniniEverest.exe instead of the intended vendor-supplied EverestEngine.exe file. **Recommendations** For Panini Everest Engine version 2.0.4, consider renaming or removing the potentially malicious Everest.exe file from the %PROGRAMDATA%Panini folder to prevent privilege escalation. As a temporary workaround, restrict access to the %PROGRAMDATA%Panini folder to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.