Vulnerability · Published Mar 28, 2024 · Assigned by Fortra
CVE-2024-0259Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04
High 7.3
In plain English
A high-severity incorrect default permissions in Robot Schedule Enterprise Agent from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | Robot Schedule Enterprise Agent | 2.0 – before 3.04 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H