CVE-2024-1201
📋 TL;DR
This vulnerability in HDD Health allows local attackers to escalate privileges by placing malicious executables in unquoted search paths. It affects users running HDD Health version 4.2.0.112 or earlier on Windows systems. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- HDD Health by PanteraSoft
📦 What is this software?
Hdd Health by Panterasoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing complete control over the affected system.
Likely Case
Local privilege escalation enabling attackers to execute code with higher privileges than their current account.
If Mitigated
Limited impact if proper access controls prevent local users from writing to vulnerable directories.
🎯 Exploit Status
Exploitation requires local access and ability to write to directories in the search path. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.0.113 or later
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/panterasoft-hdd-health-search-path-or-unquoted-item-vulnerability
Restart Required: Yes
Instructions:
1. Download latest version from official PanteraSoft website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Remove vulnerable version
windowsUninstall HDD Health until patched version can be installed
Control Panel > Programs > Uninstall a program > Select HDD Health > Uninstall
Restrict directory permissions
windowsSet strict permissions on directories in the application's search path
icacls "C:\Program Files\HDD Health" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Restrict local user access to systems running HDD Health
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check HDD Health version in About dialog or Programs list. If version is 4.2.0.112 or earlier, system is vulnerable.Check Version:
wmic product where name="HDD Health" get versionVerify Fix Applied:
Verify installed version is 4.2.0.113 or later in About dialog or Programs list.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from unusual directories
- Failed attempts to write to protected directories
Network Indicators:
- No network indicators - this is a local privilege escalation
SIEM Query:
Process creation events where parent process is HDD Health and executable path contains spaces without quotes