{"vulnerability": "CVE-2021-46439", "sightings": [{"uuid": "9095940b-422e-4672-b42a-132b4be47658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/cibsecurity/39952", "content": "\u203c CVE-2021-46439 \u203c\n\nThe WinSEGAV AutoConfig service in EG Free Antivirus v2020 suffers from a local privilege escalation vulnerability, due to unquoted paths in the service's executable path.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-01T02:18:58.000000Z"}, {"uuid": "a7f05167-6dcb-467b-a655-c47512ed908c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/hacking_Attack/48318", "content": "Exploit Collector\nEG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nEG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 1f237a69cc97f9cb11c0109dcc192e3e\n\nDownload\n# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)\n# Date: 24/01/2022\n# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)\n# Vendor Homepage: http://www.egsoftweb.in/index.aspx\n# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6\n# Version: 2020\n# Tested: Windows 10 (x64)\n# CVE: CVE-2021-46439\n\n-------------\nDescription:\n-------------\n\nEG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with\nan unquoted service path. Since this service is running as SYSTEM, it\ncreates a local privilege escalation vulnerability. To properly exploit\nthis vulnerability, a local attacker must insert an executable in the\npath of the service. Rebooting the system or restarting the service\nwill run the malicious executable with elevated privileges.\n\n------------------\nProof of Concept:\n------------------\n\nC:\\Users\\shah>sc qc  \u201cWinSEGAV AutoConfig\u201d\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: WinSEGAV AutoConfig\nTYPE               : 10  WIN32_OWN_PROCESS\nSTART_TYPE         : 2   AUTO_START\nERROR_CONTROL      : 1   NORMAL\nBINARY_PATH_NAME   : C:\\Program Files\\EGSoftWeb\\EG Anti\nVirus\\egavser.exe\nLOAD_ORDER_GROUP   :\nTAG                : 0\nDISPLAY_NAME       : Windows Service For EG Free AntiVirus\nDEPENDENCIES       :\nSERVICE_START_NAME : LocalSystem\nBest regards,\nShahrukh Iqbal Mirza. \n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:48.692417Z"}, {"uuid": "44a0cf82-1d0c-482d-86a2-770a095078dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46439", "type": "seen", "source": "https://t.me/hacking_Attack/48318", "content": "Exploit Collector\nEG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nEG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 1f237a69cc97f9cb11c0109dcc192e3e\n\nDownload\n# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)\n# Date: 24/01/2022\n# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)\n# Vendor Homepage: http://www.egsoftweb.in/index.aspx\n# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6\n# Version: 2020\n# Tested: Windows 10 (x64)\n# CVE: CVE-2021-46439\n\n-------------\nDescription:\n-------------\n\nEG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with\nan unquoted service path. Since this service is running as SYSTEM, it\ncreates a local privilege escalation vulnerability. To properly exploit\nthis vulnerability, a local attacker must insert an executable in the\npath of the service. Rebooting the system or restarting the service\nwill run the malicious executable with elevated privileges.\n\n------------------\nProof of Concept:\n------------------\n\nC:\\Users\\shah>sc qc  \u201cWinSEGAV AutoConfig\u201d\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: WinSEGAV AutoConfig\nTYPE               : 10  WIN32_OWN_PROCESS\nSTART_TYPE         : 2   AUTO_START\nERROR_CONTROL      : 1   NORMAL\nBINARY_PATH_NAME   : C:\\Program Files\\EGSoftWeb\\EG Anti\nVirus\\egavser.exe\nLOAD_ORDER_GROUP   :\nTAG                : 0\nDISPLAY_NAME       : Windows Service For EG Free AntiVirus\nDEPENDENCIES       :\nSERVICE_START_NAME : LocalSystem\nBest regards,\nShahrukh Iqbal Mirza. \n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.812098Z"}]}