PT-2022-12182 · Wondershare · Dr. Fone

Published 2022-04-29 · Updated 2022-09-09 · CVE-2021-44596

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wondershare LTD Dr. Fone as of 2021-12-06 version

Description The issue is related to remote code execution due to software design flaws. An unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service, which runs under SYSTEM privileges, and manipulate it to execute malicious executables without validation from a remote location, gaining SYSTEM privileges.

Recommendations As a temporary workaround, consider disabling the "InstallAssistService.exe" service until a patch is available. Restrict access to the service to minimize the risk of exploitation. Avoid using the service for executing external executables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-44596

Affected Products

Dr. Fone

References · 10

• 🔥 http://packetstormsecurity.com/files/167035/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/50913 · Exploit
• 🔥 https://medium.com/@tomerp_77017/wondershell-a82372914f26 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44596 · Security Note
• http://wondershare.com · Vendor Advisory
• https://t.me/cibsecurity/41630 · Telegram Post
• https://t.me/cvenotify/35942 · Telegram Post
• https://medium.com/%40tomerp_77017/wondershell-a82372914f26 · Note
• http://dr.com · Note