The flaw is an incorrect default permission setting on the pcvisit service binary installed on Windows. A local user who is not privileged can overwrite that binary with arbitrary contents. When Windows starts the machine, the service binary is automatically started with NT\SYSTEM privileges; therefore, a compromised binary grants the attacker complete control over the system.

Affected are pcvisit Remote Host Modul installations on Windows that include versions newer than 22.6.22.1329. The issue was resolved in version 25.12.3.1745 and later.

The CVSS score of 8.5 indicates a high impact vulnerability. Although no EPSS value is available, the vulnerability is not in the CISA KEV catalog. The attack vector is local; a low‑privileged user who can write to the file system can take advantage of the misconfigured permissions. Once the attacker replaces the binary, the malicious code will execute under SYSTEM level, giving full system compromise.