Local Privilege Escalation in Analog Way Picturall Quad Compact Mark II

Executive Summary

CVE-2026-14985 is a local privilege escalation vulnerability in Analog Way's Picturall Quad Compact Mark II media server firmware version 3.5.8. It occurs due to improper privilege delegation and insufficient input validation in a maintenance script called create_local_installer.sh. The script runs with root privileges but is executable by low-privileged users without a password.

Useful 0 Not Useful 0

Detection Guidance

Check if the firmware version is 3.5.8 by inspecting the device or running version-specific commands. Look for the presence of the vulnerable script create_local_installer.sh in the system. Verify if low-privileged users can execute this script without a password.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access can exploit this by crafting a malicious Ext4 disk image with a specially formatted picturall-version.txt file. The script fails to sanitize input, allowing directory traversal sequences that enable writing files outside the intended directory. This leads to arbitrary file writes in sensitive locations like /etc/cron.d, where attackers can modify system task schedules or configuration files to execute malicious code with full system privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and full system compromise, which may violate compliance requirements for data protection standards like GDPR and HIPAA. Unauthorized privilege escalation could allow attackers to access, modify, or exfiltrate sensitive data, leading to potential data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the firmware to version 3.5.9 or apply the security-only hotfix 3.5.8-security1 if a full update is not possible. Remove or restrict execution permissions for the vulnerable script create_local_installer.sh until patched.

Useful 0 Not Useful 0