CVEvulnerability
CVE-2026-4606
10.0 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-03-23
- Last modified
- 2026-06-17
- Assigner
- 0df08a0e-a200-4957-9bb0-084f562506f9
- CVSS 4.0 (0df08a0e-a200-4957-9bb0-084f562506f9)
- 10.0 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:C/RE:M/U:Green
- Weaknesses
- CWE-250
Description
GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system.
During installation, ERM creates a Windows service that runs under the LocalSystem account.
When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user.
Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories.
Any ERM function invoking Windows file open/save dialogs exposes the same risk.
This vulnerability allows local privilege escalation and may result in full system compromise.
Related
Weakness · CWE (1)
- CWE-250 Execution with Unnecessary Privileges weakness