CVE-2026-4606
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
23/03/2026
Última modificación:
23/03/2026
Descripción
*** Pendiente de traducción *** GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. <br />
<br />
During installation, ERM creates a Windows service that runs under the LocalSystem account. <br />
<br />
When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. <br />
<br />
Functions such as &#39;Import Data&#39; open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. <br />
<br />
Any ERM function invoking Windows file open/save dialogs exposes the same risk. <br />
<br />
This vulnerability allows local privilege escalation and may result in full system compromise.