CVE-2009-4606

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.80%

Published

Jan 13, 2010

Modified

Apr 22, 2026

Public PoC / Exploit (1)

All weaponized →

Exploit-DBSouth River Technologies WebDrive Service 9.02 build 2232 - Bad Security Descriptor Privilege Escalation

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.

Weaknesses (CWE)

CWE-264

Affected Products (1)

south_river_technologies · webdrivevulnerable

References (12)

http://osvdb.org/59080

http://retrogod.altervista.org/9sg_south_river_priv.html

http://secunia.com/advisories/37083

Vendor Advisory

http://www.securityfocus.com/archive/1/507323/100/0/threaded

http://www.vupen.com/english/advisories/2009/2994

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/53885

http://osvdb.org/59080

http://retrogod.altervista.org/9sg_south_river_priv.html

KEV Catalog EPSS Scores Vendors All CVEs