Executive brief
Matrix42 Remote Control Host, a tool used for remote IT assistance and desktop management, contains a security flaw in how its background services are configured. A local user with limited access to a computer could exploit this to run their own malicious programs with full administrative (SYSTEM) privileges. This could lead to a complete takeover of the affected machine, allowing an attacker to bypass security controls or access sensitive data.
Technical details
The vulnerability (CWE-428) exists because the executable paths for the 'FastViewerRemoteService' and 'FastViewerRemoteProxy' services are not enclosed in quotation marks. Because the path contains spaces (e.g., C:\Program Files (x86)\Matrix42\Remote Control Host\...), the Windows Service Control Manager may attempt to execute files at intercepted locations such as 'C:\Program.exe' or 'C:\Program Files (x86)\Matrix42\Remote.exe'. A local attacker with write permissions to these directories can place a malicious executable with the expected name, which will then be executed with SYSTEM privileges when the service starts. Manual remediation involves adding quotes to the ImagePath value in the Windows Registry for the affected services.
Affected products
- Matrix42 Remote Control Host 3.20.0031
Timeline
- 2016-06-05: disclosed: Vulnerability discovered by Roland C. Redl
- 2016-06-10: other: Exploit published on Exploit-DB
- 2026-06-19: advisory: CVE published/updated in NVD dataset