VIPRE Antivirus Plus SetPrivateConfig Directory Traversal Local Privilege Escalation Vulnerability

CVE-2023-32176

What is CVE-2023-32176?

A vulnerability has been identified in VIPRE Antivirus Plus that permits local attackers to escalate their privileges on affected installations. This issue originates from a flaw in the SetPrivateConfig method, where user-supplied paths are not properly validated prior to being used in file operations. Consequently, an attacker who has the capability to execute low-privileged code on the system can exploit this vulnerability to escalate privileges and execute arbitrary code under the context of the SYSTEM. It is imperative for users of VIPRE Antivirus Plus to remain vigilant and apply any security advisories released by the vendor.

References