CWE Code: 16
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Configuration
Summary: applications developed using the portrait display sdk, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. a number of applications developed using the portrait displays sdk do not use secure permissions when running. these applications run the component pdiservice.exe with nt authority/system permissions. this component is also read/writable by all authenticated users. this allows local authenticated attackers to run arbitrary code with system privileges. the following applications have been identified by portrait displays as affected: fujitsu displayview click: version 6.0 and 6.01. the issue was fixed in version 6.3. fujitsu displayview click suite: version 5. the issue is addressed by patch in version 5.9. hp display assistant: version 2.1. the issue was fixed in version 2.11. hp my display: version 2.0. the issue was fixed in version 2.1. philips smart control premium: versions 2.23, 2.25. the issue was fixed in version 2.26.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-07-24
Last Modified Date: 2019-10-09