CWE Code: 732
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Incorrect Permission Assignment for Critical Resource
Summary: the installer for the alcatel osprey3_mini modem component on ee ee40vb 4g mobile broadband modems with firmware before ee40_00_02.00_45 sets weak permissions (everyone:full control) for the "web connecton\ee40" and "web connecton\ee40\backgroundservice" directories, which allows local users to gain privileges, as demonstrated by inserting a trojan horse servicemanager.exe file into the "web connecton\ee40\backgroundservice" directory.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-09-26
Last Modified Date: 2019-10-03