Executive brief
Quanos SCHEMA ST4, a content management system for technical documentation, contains a security flaw in its update service. A person with low-level access to a computer where the software is installed can trick the update service into deleting or overwriting system files. This allows an attacker to gain full administrative control (SYSTEM privileges) over the affected machine, potentially leading to data theft or persistent access to the corporate network.
Technical details
A local privilege escalation vulnerability exists in the Quanos SCHEMA ST4 Client Update Service. The service runs with NT AUTHORITY\SYSTEM privileges and exposes a .NET Remoting interface over a named pipe (ST4Updater2) without sufficient access controls or authentication. A local authenticated user with low privileges can connect to this interface and invoke privileged methods such as Update(). By providing a malicious manifest and payload via HTTP, an attacker can perform arbitrary file write and delete operations as SYSTEM. This can be leveraged for full privilege escalation, for example, by overwriting sensitive DLLs used by system processes. No patch is available; the vendor recommends disabling the Client Update Service as a workaround.
Affected products
- Quanos Solutions GmbH SCHEMA ST4 on-premises All versions
Timeline
- 2025-12-19: disclosed: Initial contact with vendor by SEC Consult
- 2026-01-22: other: Vendor provided workaround to disable the service
- 2026-06-17: advisory: Public disclosure of CVE-2026-11858