PT-2024-4985 · Microsoft · Plugscheduler+2

Guillaume André · Published 2024-05-14 · Updated 2025-01-16 · CVE-2024-26238

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows 10 PLUGScheduler (affected versions not specified)

Description: The issue is related to an elevation of privilege vulnerability in the PLUGScheduler component of Windows operating systems. This vulnerability can be exploited to allow an attacker to gain elevated privileges on the system. The vulnerability is associated with an arbitrary file write, which can be used to execute code as SYSTEM by writing a DLL file in C:WindowsSystem32SprintCSP.dll and triggering the SvcRebootToFlashingMode method of the StorSvc service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2024-05509

CVE-2024-26238

Affected Products

Plugscheduler

Windows

Windows 10

References · 19

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-26238 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-26238 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05509 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-26238 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26238 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26238 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26238 · Security Note
• https://vuldb.com/?id.264263 · Note
• https://t.me/pentestingnews/47430 · Telegram Post
• https://t.me/freedomf0x/21466 · Telegram Post
• https://t.me/cybersecuritytechnologies/10568 · Telegram Post
• https://vulners.com/cve/CVE-2024-26238 · Note
• https://cybersecuritynews.com/windows-10-plugscheduler-flaw · Note
• https://vulners.com/kaspersky/KLA67433 · Note
• https://t.me/p0x3k/1791 · Telegram Post