The servereye Windows Agent (Sensorhub) includes a high‑privileged service SE3Recovery that runs as SYSTEM and watches the directory %ProgramData%\ServerEye3\update\ for a trigger file. A local standard user can create the file and specify a path to a directory containing malicious JSON instructions. The service then launches UpdaterAction.exe with SYSTEM privileges. UpdaterAction parses the instructions and performs an unvalidated copy from the user‑controlled source to a protected system destination, allowing a standard user to overwrite service binaries or other critical components. Once the binary is replaced, the service restarts it with SYSTEM privileges, resulting in a complete compromise of the machine. The weakness aligns with CWE‑269 (Privilege Escalation), CWE‑379 (Accidental Failure to Escape), and CWE‑73 (Path Traversal).

Vulnerable systems are the servereye Windows Agent (Sensorhub) from servereye GmbH, specifically versions 20.15 and earlier. The flaw resides on Windows platforms where the agent runs, and affects any installation that allows local users to write to the %ProgramData%\ServerEye3\update\ directory.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation at the current time, and the issue is not listed in the CISA KEV catalog. The attack vector is local: a non‑privileged user with access to the machine can place the trigger file and supply malicious JSON. While the likelihood is low, the impact of successful exploitation is total system compromise, giving an attacker full SYSTEM privileges.