CVE-2021-44596
high-risk
Published 2022-04-29
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges
Do I need to act?
!
42.8% chance of exploitation in next 30 days
EPSS score — higher than 57% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Dr.Fone
Affected Vendors
References (8)
Not Applicable
http://dr.com
Vendor Advisory
http://wondershare.com
Not Applicable
http://dr.com
Vendor Advisory
http://wondershare.com
54
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
17/34 · Moderate
Exposure
5/34 · Minimal