CVE-2024-36495 - CVE House
Back to Database
Status published Unknown CVE-2024-36495

Read/Write Permissions for Everyone on Configuration File

Vulnerability Description

The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is: C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-36495

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Daniel Hirschberger | SEC Consult Vulnerability Lab

References

More from Faronics

View All →
CVE-2024-8159
Deep Freeze 9.00.020.5760 - Out-of-bounds read
Medium 6.4
CVE-2024-36497
Unhashed Storage of Password
Unknown 0
CVE-2024-36496
Hardcoded Credentials
Unknown 0
CVE-2024-1618
Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard
High 7.8

Affected Vendor

Affected Software

WINSelect (Standard + Enterprise)
Vulnerable Versions:
8.30.xx.903

Timeline

Official Publish: June 24th, 2024
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-276

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification
Defense Evasion
T1078 Valid Accounts
Persistence
T1574 Hijack Execution Flow
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1005 Data from Local System
Collection