CVE-2017-7884

Severity: high (CVSS 8.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-16 · updated 2026-06-17
Weakness: CWE-427

Description

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe.

Affected products

apcupsd Apc Ups Daemon: through 3.14.14

References

http://seclists.org/fulldisclosure/2017/Jun/20
http://www.securityfocus.com/bid/99092
http://www.securitytracker.com/id/1038707
http://seclists.org/fulldisclosure/2017/Jun/20
http://www.securityfocus.com/bid/99092
http://www.securitytracker.com/id/1038707

Get alerted when CVE-2017-7884 or the next vulnerability affects your stack