| Package | Affected versions | Patched versions |
|---|---|---|
| privilege management for windows | < 25.4.270 | 25.4.270 |
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free