CVE-2026-108072: Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
TSplus Remote Access terminal or remote desktop servers where multiple users can obtain valid sessions are exposed if they use affected shared themes or operating modes. A lower-privileged user can target other users who log in with the same theme or mode.
What does an attacker need to exploit this issue?
The attacker needs a valid local session on the terminal or remote desktop server and sufficient access to modify the shared autostart1.tscr login scripts. Exploitation does not require the attacker to directly log in as the target user.
When does malicious code run, and what access can it gain?
Modified script content runs when another user logs in using the same theme or operating mode. It executes in that user's security context, which can enable lateral movement or privilege escalation if the target has greater privileges.
What can be done if a patch is not immediately available?
Restrict write access to the shared autostart1.tscr files and shared themes directory so that unprivileged users cannot modify login scripts. Review access controls for users with terminal or remote desktop sessions and limit their ability to write shared configuration or startup content.