Windows 11 devices could be hijacked with elevated privileges through attacks exploiting an unaddressed vulnerability involving Windows' management of installer file permissions, SC Media reports.
Threat actors could leverage such a security issue to enable Custom Actions bypassing typical account protections, which could eventually result in administrator access, and malware delivery, according to cybersecurity researcher Adrian Denkiewicz, whose report of the flaw to Microsoft late last year had been disregarded by the firm after failing to replicate the compromise on patched systems.
However, the vulnerability is not remotely exploitable and requires substantial social engineering to be successful.
"The MSI file utilizing a vulnerable Custom Action must be already installed on the machine. However, the issue could be handy to pentesters performing Local Privilege Elevation or as a persistence mechanism," said Denkiewicz. Microsoft has yet to respond to the report released by Denkiewicz.
