PT-2018-11601 · Microsoft+1 · Windows+1

Ben Larkin + 1 · Published 2018-07-03 · Updated 2019-10-03 · CVE-2018-13101

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RedSwimmer KioskSimple version 1.4.7.0

Description The issue concerns a privilege escalation vulnerability in the WCF endpoint of KioskSimpleService.exe. This vulnerability allows for read and write access to the Windows registry and control of services. An attacker could exploit these exposed methods to execute controlled binaries, leading to privilege escalation.

Recommendations For RedSwimmer KioskSimple version 1.4.7.0, consider restricting access to the WCF endpoint as a temporary mitigation measure until a patch is available. Avoid using the vulnerable methods in the WCF endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-13101

Affected Products

Kiosksimple

Windows

References · 3

• https://osv.dev/vulnerability/CVE-2018-13101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13101 · Security Note
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-026.md · Note