{"vulnerability": "cve-2021-3531", "sightings": [{"uuid": "b927cc1f-a42d-4454-95e0-13b1b2e99e34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35312", "type": "seen", "source": "https://t.me/cibsecurity/26957", "content": "\u203c CVE-2021-35312 \u203c\n\nA vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable \"RemoteBackup.Service.exe\" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with \"LocalSystem\" privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-06T22:33:04.000000Z"}, {"uuid": "05a9d647-4c4e-41ea-b57f-b8a50eb6149d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35313", "type": "seen", "source": "https://t.me/hacking_Attack/24540", "content": "Exploit CollectorTotalAV 5.15.69 Unquoted Service Path \n\n\nTotalAV version 5.15.69 suffers from an unquoted service path vulnerability.\n\nMD5 | f60e46c8d3377f891ee188835e438cd2\n\nDownload\n\n\n\n# Exploit Title: TotalAV - Unquoted Service Path\n# Date: 2021-09-22\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://www.totalav.com\n# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe\n# Version: 5.15.69\n# Tested on: Windows 10 Pro 20H2 and 21H1 x64\n# CVE: CVE-2021-35313\n\nThe PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service\nservices from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a\nuser to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible\nto place executable(s) following the path of the unquoted string.\n\nAffected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:\n\nPC Security Management Service       SecurityService   C:\\Program Files (x86)\\TotalAV\\SecurityService.exe       Auto\nPC Security Management Monitoring Service   SecurityServiceMonitor  C:\\Program Files (x86)\\TotalAV\\SecurityService.exe --monitor     Auto\nAnti-Malware SDK Protected Service    AMSProtectedService   C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe   Auto\n\nC:\\Users\\user>sc qc SecurityService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE     : 1   NORMAL\nNOME_PERCORSO_BINARIO    : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Service\nDIPENDENZE      :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc SecurityServiceMonitor\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityServiceMonitor\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe --monitor\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Monitoring Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc AMSProtectedService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: AMSProtectedService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : Anti-Malware SDK Protected Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\n\n\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:20.885878Z"}, {"uuid": "68b2f396-ef0b-43ad-bbb6-d86cf65db478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35312", "type": "seen", "source": "https://t.me/hacking_Attack/19237", "content": "Exploit Collector\nAmica Prodigy 1.7 Privilege Escalation\n\nhttps://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png \nAmica Prodigy version 1.7 suffers from a local privilege escalation vulnerability.\n\nMD5 | d4ff2f09e7ae96200fd8a728e5838645\n\nDownload\n# Exploit Title: Amica Prodigy 1.7 - Privilege Escalation\n# Date: 2021-08-06\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com\n# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe\n# Version: 1.7\n# Tested on: Windows 10 Pro 20H2 x64\n# CVE: CVE-2021-35312\n\nAmica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,\nfrom website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl\n\nA vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable\n\"RemoteBackup.Service.exe\" has incorrect permissions, allowing a local unprivileged user to replace it\nwith a malicious file that will be executed with \"LocalSystem\" privileges at scheduled time.\n\nC:\\Users\\user>icacls C:\\AmicaProdigy\\RemoteBackup.Service.exe\n\nC:\\AmicaProdigy\\RemoteBackup.Service.exe\nNT AUTHORITY\\Authenticated Users:(I)(M) NT\nAUTHORITY\\SYSTEM:(I)(F) BUILTIN\\Administrators:(I)(F)\nBUILTIN\\Users:(I)(RX) Elaborazione completata per 1 file.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:30.045033Z"}, {"uuid": "0162a568-1591-4e91-92e9-550f22cf0b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35313", "type": "seen", "source": "https://t.me/hacking_Attack/24540", "content": "Exploit CollectorTotalAV 5.15.69 Unquoted Service Path \n\n\nTotalAV version 5.15.69 suffers from an unquoted service path vulnerability.\n\nMD5 | f60e46c8d3377f891ee188835e438cd2\n\nDownload\n\n\n\n# Exploit Title: TotalAV - Unquoted Service Path\n# Date: 2021-09-22\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://www.totalav.com\n# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe\n# Version: 5.15.69\n# Tested on: Windows 10 Pro 20H2 and 21H1 x64\n# CVE: CVE-2021-35313\n\nThe PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service\nservices from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a\nuser to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible\nto place executable(s) following the path of the unquoted string.\n\nAffected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:\n\nPC Security Management Service       SecurityService   C:\\Program Files (x86)\\TotalAV\\SecurityService.exe       Auto\nPC Security Management Monitoring Service   SecurityServiceMonitor  C:\\Program Files (x86)\\TotalAV\\SecurityService.exe --monitor     Auto\nAnti-Malware SDK Protected Service    AMSProtectedService   C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe   Auto\n\nC:\\Users\\user>sc qc SecurityService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE     : 1   NORMAL\nNOME_PERCORSO_BINARIO    : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Service\nDIPENDENZE      :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc SecurityServiceMonitor\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityServiceMonitor\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe --monitor\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Monitoring Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc AMSProtectedService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: AMSProtectedService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : Anti-Malware SDK Protected Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\n\n\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:50.230038Z"}, {"uuid": "def29cf2-401d-469b-83ea-dc544baaf5b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35312", "type": "seen", "source": "https://t.me/hacking_Attack/19237", "content": "Exploit Collector\nAmica Prodigy 1.7 Privilege Escalation\n\nhttps://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png \nAmica Prodigy version 1.7 suffers from a local privilege escalation vulnerability.\n\nMD5 | d4ff2f09e7ae96200fd8a728e5838645\n\nDownload\n# Exploit Title: Amica Prodigy 1.7 - Privilege Escalation\n# Date: 2021-08-06\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com\n# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe\n# Version: 1.7\n# Tested on: Windows 10 Pro 20H2 x64\n# CVE: CVE-2021-35312\n\nAmica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,\nfrom website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl\n\nA vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable\n\"RemoteBackup.Service.exe\" has incorrect permissions, allowing a local unprivileged user to replace it\nwith a malicious file that will be executed with \"LocalSystem\" privileges at scheduled time.\n\nC:\\Users\\user>icacls C:\\AmicaProdigy\\RemoteBackup.Service.exe\n\nC:\\AmicaProdigy\\RemoteBackup.Service.exe\nNT AUTHORITY\\Authenticated Users:(I)(M) NT\nAUTHORITY\\SYSTEM:(I)(F) BUILTIN\\Administrators:(I)(F)\nBUILTIN\\Users:(I)(RX) Elaborazione completata per 1 file.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:04.650126Z"}, {"uuid": "2c603e91-2681-4a40-a6c5-2e91b13e9731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35313", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24540", "content": "Exploit CollectorTotalAV 5.15.69 Unquoted Service Path \n\n\nTotalAV version 5.15.69 suffers from an unquoted service path vulnerability.\n\nMD5 | f60e46c8d3377f891ee188835e438cd2\n\nDownload\n\n\n\n# Exploit Title: TotalAV - Unquoted Service Path\n# Date: 2021-09-22\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://www.totalav.com\n# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe\n# Version: 5.15.69\n# Tested on: Windows 10 Pro 20H2 and 21H1 x64\n# CVE: CVE-2021-35313\n\nThe PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service\nservices from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a\nuser to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible\nto place executable(s) following the path of the unquoted string.\n\nAffected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:\n\nPC Security Management Service       SecurityService   C:\\Program Files (x86)\\TotalAV\\SecurityService.exe       Auto\nPC Security Management Monitoring Service   SecurityServiceMonitor  C:\\Program Files (x86)\\TotalAV\\SecurityService.exe --monitor     Auto\nAnti-Malware SDK Protected Service    AMSProtectedService   C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe   Auto\n\nC:\\Users\\user>sc qc SecurityService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE     : 1   NORMAL\nNOME_PERCORSO_BINARIO    : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Service\nDIPENDENZE      :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc SecurityServiceMonitor\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityServiceMonitor\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe --monitor\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Monitoring Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc AMSProtectedService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: AMSProtectedService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : Anti-Malware SDK Protected Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\n\n\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T14:00:05.194091Z"}, {"uuid": "08c77626-56bb-4fc7-8d13-688df5c951e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35312", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/19237", "content": "Exploit Collector\nAmica Prodigy 1.7 Privilege Escalation\n\nhttps://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png \nAmica Prodigy version 1.7 suffers from a local privilege escalation vulnerability.\n\nMD5 | d4ff2f09e7ae96200fd8a728e5838645\n\nDownload\n# Exploit Title: Amica Prodigy 1.7 - Privilege Escalation\n# Date: 2021-08-06\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com\n# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe\n# Version: 1.7\n# Tested on: Windows 10 Pro 20H2 x64\n# CVE: CVE-2021-35312\n\nAmica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,\nfrom website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl\n\nA vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable\n\"RemoteBackup.Service.exe\" has incorrect permissions, allowing a local unprivileged user to replace it\nwith a malicious file that will be executed with \"LocalSystem\" privileges at scheduled time.\n\nC:\\Users\\user>icacls C:\\AmicaProdigy\\RemoteBackup.Service.exe\n\nC:\\AmicaProdigy\\RemoteBackup.Service.exe\nNT AUTHORITY\\Authenticated Users:(I)(M) NT\nAUTHORITY\\SYSTEM:(I)(F) BUILTIN\\Administrators:(I)(F)\nBUILTIN\\Users:(I)(RX) Elaborazione completata per 1 file.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T21:00:05.350028Z"}, {"uuid": "0cbf521d-300c-43d1-91c8-aef5d93afec9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35312", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/19237", "content": "Exploit Collector\nAmica Prodigy 1.7 Privilege Escalation\n\nhttps://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png \nAmica Prodigy version 1.7 suffers from a local privilege escalation vulnerability.\n\nMD5 | d4ff2f09e7ae96200fd8a728e5838645\n\nDownload\n# Exploit Title: Amica Prodigy 1.7 - Privilege Escalation\n# Date: 2021-08-06\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com\n# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe\n# Version: 1.7\n# Tested on: Windows 10 Pro 20H2 x64\n# CVE: CVE-2021-35312\n\nAmica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,\nfrom website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl\n\nA vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable\n\"RemoteBackup.Service.exe\" has incorrect permissions, allowing a local unprivileged user to replace it\nwith a malicious file that will be executed with \"LocalSystem\" privileges at scheduled time.\n\nC:\\Users\\user>icacls C:\\AmicaProdigy\\RemoteBackup.Service.exe\n\nC:\\AmicaProdigy\\RemoteBackup.Service.exe\nNT AUTHORITY\\Authenticated Users:(I)(M) NT\nAUTHORITY\\SYSTEM:(I)(F) BUILTIN\\Administrators:(I)(F)\nBUILTIN\\Users:(I)(RX) Elaborazione completata per 1 file.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:23.940874Z"}, {"uuid": "d925721c-bb8e-403c-bf95-b68141487bd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35313", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24540", "content": "Exploit CollectorTotalAV 5.15.69 Unquoted Service Path \n\n\nTotalAV version 5.15.69 suffers from an unquoted service path vulnerability.\n\nMD5 | f60e46c8d3377f891ee188835e438cd2\n\nDownload\n\n\n\n# Exploit Title: TotalAV - Unquoted Service Path\n# Date: 2021-09-22\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://www.totalav.com\n# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe\n# Version: 5.15.69\n# Tested on: Windows 10 Pro 20H2 and 21H1 x64\n# CVE: CVE-2021-35313\n\nThe PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service\nservices from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a\nuser to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible\nto place executable(s) following the path of the unquoted string.\n\nAffected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:\n\nPC Security Management Service       SecurityService   C:\\Program Files (x86)\\TotalAV\\SecurityService.exe       Auto\nPC Security Management Monitoring Service   SecurityServiceMonitor  C:\\Program Files (x86)\\TotalAV\\SecurityService.exe --monitor     Auto\nAnti-Malware SDK Protected Service    AMSProtectedService   C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe   Auto\n\nC:\\Users\\user>sc qc SecurityService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE     : 1   NORMAL\nNOME_PERCORSO_BINARIO    : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Service\nDIPENDENZE      :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc SecurityServiceMonitor\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityServiceMonitor\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe --monitor\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Monitoring Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc AMSProtectedService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: AMSProtectedService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : Anti-Malware SDK Protected Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\n\n\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:44.121573Z"}]}