CVE-2026-1680
📋 TL;DR
This vulnerability allows any local Windows user to escalate their privileges to local administrator by directly communicating with the LocalAdminService.exe named pipe. It bypasses client-side group membership restrictions in the WCF endpoint. Affected users are those running Edgemo Local Admin Service 1.2.7.23180 on Windows systems.
💻 Affected Systems
- Edgemo Local Admin Service (now owned by Danoffice IT)
📦 What is this software?
Local Admin Service by Danofficeit
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where any local user becomes local administrator, enabling installation of malware, data theft, persistence mechanisms, and lateral movement.
Likely Case
Local privilege escalation by authenticated users to gain administrative control over the system, potentially leading to credential harvesting and further network access.
If Mitigated
Limited impact if proper network segmentation, least privilege principles, and monitoring are in place to detect unusual privilege escalation attempts.
🎯 Exploit Status
Exploitation requires local access but is straightforward via named pipe communication. The retest.dk references provide technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.danofficeit.com/howwedoit/workplace/management/
Restart Required: No
Instructions:
No official patch available. Check vendor advisory for updates. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Disable LocalAdminService
windowsStop and disable the vulnerable LocalAdminService.exe service
sc stop LocalAdminService
sc config LocalAdminService start= disabled
Restrict Named Pipe Access
windowsApply stricter ACLs to the LocalAdminService named pipe
icacls \\.\pipe\LocalAdminService /deny Everyone:(F)
🧯 If You Can't Patch
- Implement strict network segmentation to limit lateral movement
- Enforce least privilege principles and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if LocalAdminService.exe version 1.2.7.23180 is running: Get-Process LocalAdminService | Select-Object Path, FileVersionCheck Version:
Get-Process LocalAdminService | Select-Object FileVersionVerify Fix Applied:
Verify service is stopped/disabled: Get-Service LocalAdminService | Select-Object Status, StartType📡 Detection & Monitoring
Log Indicators:
- Unusual named pipe access events
- Privilege escalation attempts in security logs
- LocalAdminService.exe process creation with non-admin users
Network Indicators:
- Local named pipe communication attempts to \\.\pipe\LocalAdminService
SIEM Query:
EventID=4688 AND ProcessName='LocalAdminService.exe' AND SubjectUserName NOT IN (admin_users_list)