CVE-2018-6546
📋 TL;DR
CVE-2018-6546 is a privilege escalation vulnerability in the plays.tv service that allows local users to execute arbitrary code with SYSTEM privileges by sending specially crafted HTTP messages. This affects systems with AMD driver-installation packages or Gaming Evolved products that include the vulnerable plays.tv service. Attackers can exploit this without proper authentication to gain complete system control.
💻 Affected Systems
- AMD driver-installation packages
- Gaming Evolved products
- plays.tv service
📦 What is this software?
Plays.tv by Plays.tv
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, credential theft, lateral movement, and full administrative control of the affected system.
Likely Case
Local privilege escalation leading to administrative access, enabling attackers to bypass security controls, install additional malware, or access sensitive data on the compromised system.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, though local privilege escalation would still be possible on affected systems.
🎯 Exploit Status
Multiple public exploit scripts are available that demonstrate trivial exploitation. The vulnerability requires network access to the plays.tv service HTTP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.27.7.0 and later
Vendor Advisory: https://www.amd.com/en/corporate/product-security
Restart Required: Yes
Instructions:
1. Update AMD drivers to latest version. 2. Update Gaming Evolved software to latest version. 3. Ensure plays.tv service is updated to version 1.27.7.0 or later. 4. Restart the system to apply changes.
🔧 Temporary Workarounds
Disable plays.tv service
windowsStop and disable the vulnerable plays.tv service to prevent exploitation
sc stop plays_service
sc config plays_service start= disabled
Block network access to plays.tv service
windowsUse Windows Firewall to block inbound connections to the plays.tv service HTTP endpoint
netsh advfirewall firewall add rule name="Block plays.tv" dir=in action=block program="C:\Program Files (x86)\AMD\plays.tv\plays_service.exe" enable=yes
🧯 If You Can't Patch
- Remove or disable the plays.tv service entirely from affected systems
- Implement strict network segmentation to isolate systems with vulnerable plays.tv service from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if plays_service.exe is running and its version is below 1.27.7.0. Look for the service listening on HTTP ports.Check Version:
wmic service where "name='plays_service'" get pathname | findstr /i plays_serviceVerify Fix Applied:
Verify plays.tv service version is 1.27.7.0 or later. Check that the service no longer accepts execute_installer parameter without proper authentication.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to plays.tv service with execute_installer parameter
- Unusual process creation from plays_service.exe with SYSTEM privileges
- Network connections to SMB shares initiated by SYSTEM account
Network Indicators:
- HTTP traffic to plays.tv service endpoint with suspicious parameters
- SMB connections originating from system IP with unusual file paths
SIEM Query:
source="windows" AND (process_name="plays_service.exe" AND (command_line="*execute_installer*" OR parent_process="SYSTEM"))