Executive brief
Privacy Drive is an encryption software used to secure sensitive files and folders on Windows systems. A security flaw in how the software starts its background service allows a local user with limited access to gain full administrative control over the computer. By placing a malicious file in a specific location, an attacker can trick the system into running their code with the highest possible system privileges during a reboot.
Technical details
The vulnerability exists due to an unquoted service path in the 'pdsvc.exe' binary (PDSvc service). When a service path contains spaces and is not enclosed in quotation marks, Windows attempts to locate and execute programs at every space-delimited point in the path. A local attacker with file system permissions to write to the parent directories (e.g., C:\) can place a malicious executable named 'Program.exe' or 'Cybertron.exe' to intercept the service launch. Since the service is configured to run as 'LocalSystem', the attacker's code will execute with full system privileges upon service startup or system reboot. This is classified as CWE-428.
Affected products
- Cybertron Software Privacy Drive 3.17.0 Build 1456 and earlier
Timeline
- 2020-08-20: disclosed: Initial discovery by researcher
- 2020-11-09: other: Exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published and added to NVD