Executive brief
Argus Surveillance DVR, a software used for managing security camera recordings, contains a flaw in how its background monitoring service is configured. A user who already has basic access to the computer can exploit this to gain full administrative control (LocalSystem privileges). This could allow an attacker to disable security monitoring, access sensitive video data, or compromise the entire host system.
Technical details
The DVRWatchdog service (ARGUSSURVEILLANCEDVR_WATCHDOG) in Argus Surveillance DVR 4.0 is configured with an unquoted binary path containing spaces: 'C:\Program Files\Argus Surveillance DVR\DVRWatchdog.exe'. Because the path is not enclosed in quotation marks, the Windows Service Control Manager may attempt to execute files at 'C:\Program.exe' or 'C:\Program Files\Argus.exe' if they exist. A local attacker with write permissions to these directories can place a malicious executable there to achieve privilege escalation. The exploit requires the 'Start as service on Windows Startup' option to be enabled and results in code execution with LocalSystem privileges.
Affected products
- Argus Argus Surveillance DVR 4.0
Timeline
- 2021-09-03: disclosed: Initial discovery and exploit development by Salman Asad
- 2021-09-06: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published