CVE-2024-50590: Local Privilege Escalation via Weak Service Binary Permissions

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-08 · updated 2026-06-17
Weakness: CWE-250

Description

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”. Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".

Affected products

HASOMED Elefant: before 24.04.00 — fixed in 24.04.00

How to fix

Upgrade to a fixed version: HASOMED Elefant 24.04.00. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50590 or the next vulnerability affects your stack