Description

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

Severity (CVSS)

Base score8.5
SeverityHigh
VersionCVSS 4.0
VectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Provided byCNA

Weaknesses

  • — CWE-732 Incorrect Permission Assignment for Critical Resource

Affected products

VendorProductVersions
Cloud Foundry Foundationbosh-windows-stemcell-builder0 to <2019.98

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 09 Jul 2026 07:08 UTC.