A vulnerability exists in the pre-installed application of the HP computer will allow the hacker to completely take over the system

Recently, SafeBreach Labs security researchers revealed a privilege escalation vulnerability (CVE-2019-6333) in a pre-installed HP computer, HP Touchpoint Analytics that could allow an attacker to completely take over the system.

It is understood that HP Touchpoint Analytics software mainly collects diagnostic data about hardware performance and transmits the data to Hewlett Packard to help technicians diagnose problems. In order to collect information among various software drivers and other components, the application was whitelisted and given administrator privileges.

“HP Services”by andy bryant is licensed under CC BY-NC-SA 2.0

The researchers found that when HP Touchpoint Analytics was activated, the app would try to load a DLL file that was lost. The hacker can change the name of the malicious DLL file to the name of the missing file and then automatically execute the malicious file command. Once the intrusion is successful, the hacker can easily escalate his privilege to the SYSTEM level, bypassing various defenses and even taking over the system.

According to SafeBreach, tens of millions of HP computers will be affected because of this vulnerability exists in all older versions of HPTouchpoint Analytics (below 4.1.4.2827). Currently, HP has released the HP Touchpoint Analytics Client version 4.1.4.2827 to fix this vulnerability.

Via: ZDNet