https://vulnerability.circl.lu/sightings/feed 2026-09-05T15:09:35.717492+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/44a0cf82-1d0c-482d-86a2-770a095078dd/export 2026-09-05T15:09:35.740869+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "44a0cf82-1d0c-482d-86a2-770a095078dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/hacking_Attack/48318", "content": "Exploit Collector\nEG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nEG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 1f237a69cc97f9cb11c0109dcc192e3e\n\nDownload\n# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)\n# Date: 24/01/2022\n# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)\n# Vendor Homepage: http://www.egsoftweb.in/index.aspx\n# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6\n# Version: 2020\n# Tested: Windows 10 (x64)\n# CVE: CVE-2021-46439\n\n-------------\nDescription:\n-------------\n\nEG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with\nan unquoted service path. Since this service is running as SYSTEM, it\ncreates a local privilege escalation vulnerability. To properly exploit\nthis vulnerability, a local attacker must insert an executable in the\npath of the service. Rebooting the system or restarting the service\nwill run the malicious executable with elevated privileges.\n\n------------------\nProof of Concept:\n------------------\n\nC:\\Users\\shah>sc qc \u201cWinSEGAV AutoConfig\u201d\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: WinSEGAV AutoConfig\nTYPE : 10 WIN32_OWN_PROCESS\nSTART_TYPE : 2 AUTO_START\nERROR_CONTROL : 1 NORMAL\nBINARY_PATH_NAME : C:\\Program Files\\EGSoftWeb\\EG Anti\nVirus\\egavser.exe\nLOAD_ORDER_GROUP :\nTAG : 0\nDISPLAY_NAME : Windows Service For EG Free AntiVirus\nDEPENDENCIES :\nSERVICE_START_NAME : LocalSystem\nBest regards,\nShahrukh Iqbal Mirza. \n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.812098Z"} 2026-09-02T01:02:01.812098+00:00 https://vulnerability.circl.lu/sighting/a7f05167-6dcb-467b-a655-c47512ed908c/export 2026-09-05T15:09:35.743603+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a7f05167-6dcb-467b-a655-c47512ed908c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/hacking_Attack/48318", "content": "Exploit Collector\nEG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nEG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 1f237a69cc97f9cb11c0109dcc192e3e\n\nDownload\n# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)\n# Date: 24/01/2022\n# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)\n# Vendor Homepage: http://www.egsoftweb.in/index.aspx\n# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6\n# Version: 2020\n# Tested: Windows 10 (x64)\n# CVE: CVE-2021-46439\n\n-------------\nDescription:\n-------------\n\nEG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with\nan unquoted service path. Since this service is running as SYSTEM, it\ncreates a local privilege escalation vulnerability. To properly exploit\nthis vulnerability, a local attacker must insert an executable in the\npath of the service. Rebooting the system or restarting the service\nwill run the malicious executable with elevated privileges.\n\n------------------\nProof of Concept:\n------------------\n\nC:\\Users\\shah>sc qc \u201cWinSEGAV AutoConfig\u201d\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: WinSEGAV AutoConfig\nTYPE : 10 WIN32_OWN_PROCESS\nSTART_TYPE : 2 AUTO_START\nERROR_CONTROL : 1 NORMAL\nBINARY_PATH_NAME : C:\\Program Files\\EGSoftWeb\\EG Anti\nVirus\\egavser.exe\nLOAD_ORDER_GROUP :\nTAG : 0\nDISPLAY_NAME : Windows Service For EG Free AntiVirus\nDEPENDENCIES :\nSERVICE_START_NAME : LocalSystem\nBest regards,\nShahrukh Iqbal Mirza. \n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:48.692417Z"} 2026-09-01T20:01:48.692417+00:00 https://vulnerability.circl.lu/sighting/9095940b-422e-4672-b42a-132b4be47658/export 2026-09-05T15:09:35.743711+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9095940b-422e-4672-b42a-132b4be47658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/cibsecurity/39952", "content": "\u203c CVE-2021-46439 \u203c\n\nThe WinSEGAV AutoConfig service in EG Free Antivirus v2020 suffers from a local privilege escalation vulnerability, due to unquoted paths in the service's executable path.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-01T02:18:58.000000Z"} 2022-04-01T02:18:58+00:00