Vulnerability in Webroot Antivirus (CVE-2023-7241)

The fixed vulnerability allowed an attacker to escalate his privileges to SYSTEM on a system that the attacker already had access to.

This was possible by using COM-Hijacking to execute code in the context of a trusted front-end process. The trust between the front end and the back end was then abused for an arbitrary file delete, which allowed the execution of code as SYSTEM.

We want to thank OpenText for their exemplary reaction to the vulnerability report.

CVSS Score
7.8 (CVSS v3) – https://nvd.nist.gov/vuln/detail/CVE-2023-7241

CVSS Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Affected Versions
Webroot Antivirus 8.0.1X- 9.0.35.12

Fixed Version
9.0.35.17

References
https://answers.webroot.com/Webroot/ukp.aspx?&app=vw&vw=1&login=1&solutionid=4258

Credits
Kolja Grassmann (cirosec GmbH) and Alain Rödel (Neodyme)