Unchecked Search Path Element in Evope Collector

Executive Summary

CVE-2026-7169 is a high-severity vulnerability in Evope Collector versions before 1.1.7.13. It involves an unchecked search path element where the application loads a malicious DLL named 'wtsapi32.dll' from 'C:\ProgramData\Evope\' without verifying its integrity. The 'Evope.Service.exe' component runs with SYSTEM privileges and fails to validate the DLL, allowing a local attacker without privileges to place the malicious file and execute code with SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of 'wtsapi32.dll' in 'C:\ProgramData\Evope\' on systems running Evope Collector versions prior to 1.1.7.13. Verify the file's integrity and origin. Use process monitoring tools to detect unexpected DLL loads by 'Evope.Service.exe'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to escalate privileges to SYSTEM level by placing a malicious DLL in a specific directory. Successful exploitation could lead to full system compromise, unauthorized access, or installation of malware. Systems running vulnerable versions of Evope Collector are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution with SYSTEM privileges, potentially compromising sensitive data. For GDPR, it may result in unauthorized access to personal data, violating confidentiality and integrity requirements. For HIPAA, it could allow access to protected health information, breaching security rules. Organizations using affected versions must address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update Evope Collector to version 1.1.7.13 or later immediately. Remove any untrusted 'wtsapi32.dll' files from 'C:\ProgramData\Evope\'. Restrict write permissions to the directory to prevent unauthorized DLL placement.

Useful 0 Not Useful 0