HP Client Automation radexecd.exe Remote Command Execution
Critical Nessus Plugin ID 56166
SynopsisThe HP Client Automation service on the remote port can run commands on the local system without authentication.
DescriptionThe HP Client Automation service on the remote port is affected by a command execution vulnerability. The vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Client Automation. Authentication is not required to exploit the vulnerability.
The flaw exists within the radexecd.exe component. When handling a remote execute request, the process does not properly authenticate the user issuing the request. Utilities are stored in the 'secure' path that could allow an attacker to re-execute an arbitrary executable. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
SolutionSee the advisory for a possible solution. Alternatively, block access to the port.