CyberRota Analysis
AI-GeneratedThe Netdata Windows Agent versions 2.0.0 to 2.10.4 are vulnerable due to the MSI repair process launching PowerShell and wevtutil as elevated interactive processes, allowing low-privileged local users to potentially hijack these processes and execute arbitrary commands with SYSTEM privileges. This poses a significant security risk, particularly for environments where multiple users have access to the same system. Organizations using affected versions should prioritize upgrading to version 2.10.4 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.