CVE-2021-45912

EUVD-2021-32627
An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
controlupreal-time_agent
𝑥
< 8.5
controlupreal-time_agent
𝑥
< 8.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://controlup.com
https://www.controlup.com/security/security-advisory-local-privilege-escalation/
https://controlup.com
https://www.controlup.com/security/security-advisory-local-privilege-escalation/