PT-2024-18171 · Faronics · Faronics Deep Freeze Server Standard

Rafael Pedrero · Published 2024-03-12 · Updated 2024-03-13 · CVE-2024-1618

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Faronics Deep Freeze Server Standard versions 8.30.020.4627 and earlier

Description A search path or unquoted item vulnerability affects the DFServ.exe file, allowing an attacker with local user privileges to replace the legitimate DFServ.exe service executable with a malicious file of the same name. This enables the attacker to execute arbitrary code, gain unauthorized access to the compromised system, or stop the service from running when it starts.

Recommendations For versions 8.30.020.4627 and earlier, consider disabling the DFServ.exe service until a patch is available to prevent exploitation. Restrict access to the directory containing the DFServ.exe file to minimize the risk of replacing the legitimate executable with a malicious one. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2024-1618

Affected Products

Faronics Deep Freeze Server Standard

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-1618 · Security Note
• https://twitter.com/CVEnew/status/1767570071101096170 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/unquoted-item-or-search-path-vulnerability-faronics-deep-freeze-server · Note
• https://twitter.com/cracbot/status/1767989746351948277 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767595930113437753 · Twitter Post