CVE-2020-28175
📋 TL;DR
CVE-2020-28175 is a local privilege escalation vulnerability in SpeedFan 4.52 that allows attackers with local access to execute arbitrary code with elevated SYSTEM privileges. This affects users running SpeedFan 4.52 on Windows systems. The vulnerability enables attackers to bypass normal user restrictions and gain complete control of the system.
💻 Affected Systems
- Alfredo Milani Comparetti SpeedFan
📦 What is this software?
Speedfan by Almico
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attackers gain SYSTEM privileges, install persistent malware, steal credentials, and pivot to other systems on the network.
Likely Case
Local attackers escalate privileges to install additional malware, disable security controls, or access protected system resources and data.
If Mitigated
Limited impact with proper user access controls, application whitelisting, and monitoring in place to detect privilege escalation attempts.
🎯 Exploit Status
Public exploit code is available on GitHub. Exploitation requires local access to the system and basic programming knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.almico.com/speedfan.php
Restart Required: No
Instructions:
No official patch is available. Consider upgrading to a newer version if available or removing SpeedFan entirely.
🔧 Temporary Workarounds
Remove SpeedFan 4.52
windowsUninstall SpeedFan 4.52 from affected systems to eliminate the vulnerability
Control Panel > Programs > Uninstall a program > Select SpeedFan 4.52 > Uninstall
Restrict User Permissions
windowsLimit user access to systems running SpeedFan and implement least privilege principles
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized program execution
- Enable Windows Defender Application Control or similar solutions to restrict privilege escalation
🔍 How to Verify
Check if Vulnerable:
Check if SpeedFan 4.52 is installed via Control Panel > Programs > Programs and FeaturesCheck Version:
wmic product where name="SpeedFan" get versionVerify Fix Applied:
Verify SpeedFan 4.52 is no longer installed or has been upgraded to a newer version📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing privilege escalation attempts
- Process creation events for SpeedFan with unusual parent processes
Network Indicators:
- No network indicators as this is a local privilege escalation
SIEM Query:
EventID=4688 AND ProcessName="speedfan.exe" AND ParentProcess NOT IN ("explorer.exe", "cmd.exe")