CVE-2021-4480: Dräger Protector Privilege Escalation Flaw

CVE-2021-4480 Overview

CVE-2021-4480 is a local privilege escalation vulnerability in Dräger Protector Software versions prior to 6.4.2. The flaw stems from insecure file system permissions [CWE-732] that allow local users to modify binaries or loaded modules used by the application. An attacker who replaces these files can execute arbitrary code under the NT SYSTEM account when the affected service runs. The issue is tracked under EPSS at 0.015% (3.424 percentile), reflecting limited observed exploitation activity to date.

Critical Impact
A local attacker can escalate from a standard user context to NT SYSTEM by replacing trusted binaries or DLLs loaded by Dräger Protector Software.

Affected Products

Dräger Protector Software versions prior to 6.4.2

Discovery Timeline

2026-06-02 - CVE-2021-4480 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2021-4480

Vulnerability Analysis

The vulnerability is classified under [CWE-732: Incorrect Permission Assignment for Critical Resource]. Dräger Protector Software installs files and directories with permissions that permit modification by non-privileged local users. Because the affected components run with elevated privileges, any replacement binary or module executes within the security context of NT SYSTEM. This converts a low-privileged foothold into full host compromise without requiring memory corruption or kernel exploitation.

Root Cause

The root cause is improper access control on installation directories and the executables, libraries, or configuration files within them. Standard Windows hardening requires that program files protected against modification by non-administrative users. The affected versions ship with permissive Access Control Lists (ACLs) on these resources, leaving them writable by the Users or Authenticated Users group.

Attack Vector

Exploitation requires local access to a host running an affected version of Dräger Protector Software. The attacker identifies a writable executable or DLL loaded by a privileged service or scheduled task. The attacker overwrites the file with a malicious payload and waits for the affected component to load it, or triggers a restart. Execution then occurs under NT SYSTEM. User interaction is required to invoke the affected workflow, consistent with the CVSS attack requirements.

No verified public proof-of-concept code is available. Refer to the Dräger Security Vulnerabilities Report and the VulnCheck Advisory on Privilege Escalation for vendor and third-party technical details.

Detection Methods for CVE-2021-4480

Indicators of Compromise

Modification timestamps on files within the Dräger Protector Software installation directory that do not align with vendor update activity.
Unexpected child processes spawned by Dräger Protector Software services running as NT SYSTEM.
Presence of unsigned or non-vendor-signed DLLs loaded by Dräger Protector Software processes.

Detection Strategies

Audit ACLs on the Dräger Protector Software installation path and flag any entries granting write access to non-administrative principals.
Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 7 (ImageLoad) for the installation directory to surface tampering.
Hash all binaries and DLLs in the installation tree and compare against vendor-supplied reference values.

Monitoring Recommendations

Forward file integrity and process creation events to a centralized analytics platform for correlation across hosts.
Alert on any process started by the Dräger service that is not on a known-good allowlist.
Monitor Windows Service configuration changes and binary path modifications associated with Dräger components.

How to Mitigate CVE-2021-4480

Immediate Actions Required

Upgrade Dräger Protector Software to version 6.4.2 or later on all affected hosts.
Inventory all systems running Dräger Protector Software and verify installed versions against the vendor advisory.
Restrict local logon rights on hosts running the software to reduce the pool of users able to exploit local flaws.

Patch Information

Dräger has released Protector Software version 6.4.2, which corrects the insecure permissions. Refer to the Dräger Security Vulnerabilities Report for vendor patch guidance and verification steps.

Workarounds

Manually tighten ACLs on the installation directory so that only Administrators and SYSTEM retain write permissions.
Apply application allowlisting (for example, Windows Defender Application Control) to prevent unauthorized binaries from loading into privileged processes.
Remove the software from systems where it is not strictly required until patching is completed.

bash

# Configuration example: audit and harden ACLs on the install directory
icacls "C:\Program Files\Draeger\Protector"
icacls "C:\Program Files\Draeger\Protector" /inheritance:r
icacls "C:\Program Files\Draeger\Protector" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"