Home

Description

Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the Program Files directory to be executed with LocalSystem privileges when the service starts.

PUBLISHED Reserved 2026-02-01 | Published 2026-05-10 | Updated 2026-05-10 | Assigner VulnCheck




HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Unquoted Search Path or Element

Product status

Argus Surveillance DVR 4.0
affected

Credits

Salman Asad (@deathflash1411) a.k.a LeoBreaker finder

References

www.exploit-db.com/exploits/50261 (ExploitDB-50261) exploit

www.vulncheck.com/...uoted-service-path-privilege-escalation (VulnCheck Advisory: Argus Surveillance DVR 4.0 Unquoted Service Path Privilege Escalation) third-party-advisory

cve.org (CVE-2021-47945)

nvd.nist.gov (CVE-2021-47945)

Download JSON