CyberRota Analysis
AI-GeneratedThe vulnerability affects the Netdata Windows Agent, where the MSI repair process allows a low-privileged user to execute commands with SYSTEM privileges due to the loading of a user-specific PowerShell profile. This poses a significant risk, as it can lead to unauthorized access and control over the system. Organizations using versions 2.0.0 to 2.10.4 of the Netdata Windows Agent should prioritize updating to version 2.10.4 or later to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.