CVEvulnerability

CVE-2021-44596

9.8 CRITICAL Published 2022-04-29 Modified 2026-07-09 Official page ↗

Status: Modified
Published: 2022-04-29
Last modified: 2026-07-09
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges

Affected configurations

• wondershare dr.fone 2021-12-06

References

http://packetstormsecurity.com/files/167035/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
https://medium.com/@tomerp_77017/wondershell-a82372914f26 medium.com
http://packetstormsecurity.com/files/167035/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
https://medium.com/%40tomerp_77017/wondershell-a82372914f26 medium.com