CVE-2021-35312

EPSS 1.1%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

06 Aug 2021Published on NVD

10 Aug 2021Public PoC

Weaponization speed

3 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.htmlunverified cve_referencepacketstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.htmlunverified exploitdbwww.exploit-db.com/exploits/50184unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html https://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html