This vulnerability exists in Wowza Streaming Engine version 4.5.0. Improper file permissions grant full access to the Everyone group on certain executables, notably nssm_x64.exe. An authenticated user can replace the binary with a malicious executable. When the manager or engine service restarts, the replaced binary runs with LocalSystem privileges, giving the attacker complete control over the host. The weakness is a case of unauthorized modification of a privileged resource (CWE-639).

The affected product is Wowza Media Systems, LLC – Wowza Streaming Engine 4.5.0. Only this specific release is impacted, as indicated by the CPE string cpe:2.3:a:wowza:streaming_engine:4.5.0:*:*:*:*:*:*:*.

The CVSS v3.1 score is 8.5, classifying it as High severity. The EPSS score is under 1%, indicating a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread, documented exploits. Attackers need local authentication to replace the binary; however, once they do, the exploitation path is straightforward and delivers SYSTEM-level privileges upon service restart. Because the attack vector requires local access, the immediate risk is highest for environments where users have local administrative or service restart rights.