CVE-2026-7169: Uncontrolled Search Path Element in Evope Collector
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Evope Collectorto a version that resolves this vulnerability.Fixed in 1.1.7.13
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs local access to the affected system and does not need privileges. Exploitation requires placing a malicious wtsapi32.dll file in C:\ProgramData\Evope\.
What is the impact of successful exploitation?
The Evope.Service.exe component runs as NT AUTHORITY\SYSTEM and may load the attacker-controlled DLL. This can result in code execution with SYSTEM privileges and local privilege escalation.
Which installations are affected?
Evope Collector versions prior to 1.1.7.13 are affected. The vulnerable behavior involves the service loading wtsapi32.dll from C:\ProgramData\Evope\ without properly validating its origin or integrity.