The vulnerability arises from ArubaSign’s installation routine granting the Windows “Everyone” group full permissions on the main executable and supporting files in C:\Program Files. This overly permissive setting allows a non‑privileged user to overwrite those binaries with malicious code, which then runs with the integrity level of the replacing process. The result is a possibility for arbitrary code execution locally. In the worst case, if the replaced code runs with elevated privileges such as Administrator or SYSTEM, the attacker can achieve full system compromise, violating confidentiality, integrity, and availability. No official fix has been reported at this time, so the risk remains until a vendor patch is released.

ArubaSign from Aruba, versions prior to 4.6.6 installed on Windows systems. Users running the software without administrative rights on these versions are vulnerable because the installed files are writable by all users.

The CVSS score of 8.8 indicates high severity, and the vulnerability is exploitable by any user who can run code locally on the machine – the likely attack vector is a local, non‑privileged user modifying the binaries during or after installation. EPSS data is unavailable, so the exact likelihood cannot be quantified, but the lack of an official fix and the widespread insecure file permission pattern raise the risk. The vulnerability is not listed in CISA’s KEV catalog, but its high severity and the ease of exploitation make it a candidate for active monitoring and defensive action.