PT-2024-14876 · Lakeside · Systrack Lsiagent Installer

Andrew Oliveau

+2

·

Published

2024-10-18

·

Updated

2025-02-07

·

CVE-2023-6080

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows
Description The issue is a local privilege escalation vulnerability that allows attackers to gain SYSTEM level access. This flaw is present in the SysTrack LsiAgent Installer for Windows, which can be exploited by low-privilege users to execute arbitrary code. The vulnerability was discovered and reported by Mandiant, and it is related to flaws in the MSI repair process.
Recommendations For Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows, update to version 11.0 to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable installer until a patch is applied. Ensure your systems are updated to the latest version to minimize the risk of exploitation.

Fix

LPE

Weakness Enumeration

CWE-379

Related Identifiers

CVE-2023-6080

Affected Products

Systrack Lsiagent Installer