Critical Zero-Days in Atera Windows Installers Expose Users to Privilege Escalation Attacks
24-Jul-23
Privilege escalation attacks could be launched using zero-day flaws in Windows Installers for the Atera remote monitoring and management software. The holes, identified as CVE-2023-26077 and CVE-2023-26078 by Mandiant on February 28, 2023, were fixed in Atera’s versions 1.8.3.7 and 1.8.4.9, which were made available on April 17, 2023, and June 26, 2023, respectively.
According to security expert Andrew Oliveau, “the ability to initiate an operation from an NT AUTHORITYSYSTEM context can present potential security risks if not properly managed.” For instance, attackers may use improperly configured Custom Actions running as NT AUTHORITYSYSTEM to carry out local privilege escalation attacks.
