Executive brief
A vulnerability in the MSI NBFoundation Service, a component of MSI Center used for system management on MSI laptops and desktops, allows a local user to gain unauthorized control over the computer. By exploiting insecure communication settings, an attacker can read, modify, or delete critical system registry keys. This could lead to permanent system access, the ability to disable security software, or the corruption of the operating system.
Technical details
The MSI NBFoundation Service (MSIAPService.exe), which runs as NT AUTHORITY\SYSTEM, exposes a named pipe (\\.\pipe\MSI_SERVICE_2) with a DACL that grants access to all 'Authenticated Users'. While the pipe uses 3DES-ECB encryption, the key is derived from predictable strings and the current date, allowing any local user to bypass this protection. The service's 'REG' command group (including RREQ, WREQ, and DREQ) lacks caller authentication, permitting an unprivileged local attacker to read, write, or delete arbitrary registry keys in the HKLM and HKCU hives. This can be leveraged for persistence or service hijacking. The issue is resolved in MSI Center version 2.0.70.0.
Affected products
- Micro-Star International (MSI) MSI Center (MSI NBFoundation Service) <= 2.0.2506.1201
Timeline
- 2026-02-28: disclosed: Initial disclosure to MSI PSIRT
- 2026-06-21: patched: Fixed in MSI Center 2.0.70.0
- 2026-06-25: advisory: NVD publication date