CVEvulnerability

CVE-2026-9489

8.5 HIGH Published 2026-05-25 Modified 2026-07-23 Official page ↗
Status
Awaiting Analysis
Published
2026-05-25
Last modified
2026-07-23
Assigner
8fc372e3-d9c5-46e4-9410-38469745c639
CVSS 4.0 (8fc372e3-d9c5-46e4-9410-38469745c639)
8.5 HIGH — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-22, CWE-269, CWE-284, CWE-732

Description

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

Related

Weakness · CWE (4)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-269 Improper Privilege Management weakness
  • CWE-284 Improper Access Control weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References