Executive brief
Splinterware System Scheduler Pro is an automation tool used to schedule applications and manage system processes on Windows. A security flaw in the software's installation settings allows any user on a computer to replace the application's core service files with malicious code. If exploited, an attacker with limited access can take full control of the entire system with administrative privileges.
Technical details
Splinterware System Scheduler Pro 5.12 suffers from an incorrect default permission (CWE-276) vulnerability where the 'Everyone' group is granted Modify (M) permissions on the installation directory (C:\Program Files (x86)\SystemScheduler). This allows a local, unprivileged attacker to rename the legitimate service executable (WService.exe) and replace it with a malicious binary. Because the 'WindowsScheduler' service runs with LocalSystem privileges and is periodically triggered or automatically started, the attacker's code will execute with the highest system privileges. No special user interaction or administrative rights are required to perform the file replacement.
Affected products
- Splinterware System Scheduler Pro 5.12 and earlier
Timeline
- 2018-07-21: disclosed: Vulnerability discovered and exploit developed by bzyo
- 2018-07-23: other: Exploit published on Exploit-DB
- 2026-05-25: advisory: CVE-2018-25359 published via VulnCheck/NVD