CVE-2025-24864 Overview
CVE-2025-24864 is a local privilege escalation vulnerability in RemoteView Agent for Windows. The flaw stems from incorrect access permissions applied to a specific folder used by the agent. A non-administrative user on a remote PC running an affected agent version can leverage the misconfigured folder to execute arbitrary operating system commands under the LocalSystem account.
The issue is classified under [CWE-276] Incorrect Default Permissions. It affects RemoteView Agent for Windows versions prior to v8.1.5.2.
Critical Impact
A low-privileged local user can escalate to LocalSystem and execute arbitrary OS commands, resulting in full compromise of the host running the vulnerable RemoteView Agent.
Affected Products
- RemoteView Agent for Windows versions prior to v8.1.5.2
- Windows endpoints running the RemoteView remote-access service
- Environments using RemoteView for unattended remote support
Discovery Timeline
- 2025-03-06 - CVE-2025-24864 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24864
Vulnerability Analysis
RemoteView Agent installs and operates a directory whose access control list grants write permissions to non-administrative local users. Because the agent's service runs as LocalSystem, files placed or modified in this folder are executed with the highest local privilege. An authenticated local attacker can drop or replace an executable, DLL, or configuration file in the writable folder and wait for the service to load it.
The result is arbitrary OS command execution as LocalSystem. This defeats the standard Windows separation between user and system contexts and gives the attacker complete control of the endpoint, including credential theft, persistence, and lateral movement staging.
Root Cause
The root cause is improper permissions on a specific installation folder. During deployment, the agent does not restrict the folder's access control entries to privileged principals such as SYSTEM and Administrators. Standard users retain write access, violating the least-privilege principle expected of a service running under LocalSystem.
Attack Vector
Exploitation requires local access with low privileges. An attacker with an interactive session or a foothold from a phishing or malware infection writes a malicious payload into the vulnerable folder. When the RemoteView Agent service loads that file, the payload runs as LocalSystem. No user interaction is required after the file is planted.
See the JVN #24992507 Security Advisory and the Rview Emergency Patch Summary for vendor technical details.
Detection Methods for CVE-2025-24864
Indicators of Compromise
- Unexpected executable, DLL, or script files written to the RemoteView Agent installation directory by non-administrative users
- New child processes spawned by the RemoteView Agent service running as NT AUTHORITY\SYSTEM
- Modifications to service binaries or configuration files under the RemoteView folder outside of vendor update windows
Detection Strategies
- Audit the access control list on the RemoteView Agent folder and flag any writable permissions granted to Users, Authenticated Users, or Everyone
- Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for file writes and executions under the RemoteView directory
- Correlate service restarts of the RemoteView Agent with recent file changes in its installation path
Monitoring Recommendations
- Enable command-line and parent-process logging on all Windows endpoints running RemoteView Agent
- Alert on processes launched by the RemoteView Agent service whose image paths deviate from the vendor-signed binary list
- Track privileged token use originating from the RemoteView Agent process tree to identify post-exploitation activity
How to Mitigate CVE-2025-24864
Immediate Actions Required
- Upgrade RemoteView Agent for Windows to version v8.1.5.2 or later on every affected endpoint
- Inventory hosts running the RemoteView Agent service and prioritize systems with multiple interactive users
- Restrict interactive logon on servers that run the agent until patching completes
Patch Information
The vendor released a fixed build in RemoteView Agent v8.1.5.2. Details are documented in the Rview Emergency Patch Summary and the JVN #24992507 Security Advisory. Apply the patch through the vendor's update channel and verify the installed version afterward.
Workarounds
- Manually harden the ACL on the RemoteView Agent folder to remove write access for non-administrative principals
- Remove the RemoteView Agent from hosts that do not require unattended remote support
- Enforce application allowlisting to prevent unsigned binaries in the RemoteView directory from executing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
