CVE-2018-6546

published 2018-04-13

CVE-2018-6546: plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a…

Priority P2 68 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a user-defined (local or SMB) path as SYSTEM when the execute_installer parameter is used in an HTTP message. This occurs without properly authenticating the user.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
plays.tv	plays.tv	< 1.27.7.0	1.27.7.0

Detection & IOCs extracted from sources · hover to see the quote

filename plays_service.exe↗

path /execute_installer↗

port 50452↗

other a%qs0t33QgiE6ut^0I&Y↗

url http://127.0.0.1:50452/execute_installer↗

• → Monitor for HTTP POST requests to the /execute_installer endpoint on the ephemeral port stored in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PlaysTV\Service; requests include 'data' (JSON) and 'hash' (MD5) POST parameters. ↗
• → Flag SMB-path arguments (e.g., UNC paths starting with '\\\\') passed to plays_service.exe as the installer parameter, indicating potential remote code execution via SMB share. ↗
• → Alert on HTTP POST bodies containing the literal string 'Security failed - Missing hash or message' in responses, which confirms the presence of the vulnerable Raptr/Plays TV service. ↗

• · Authentication is bypassed entirely — the service does not properly authenticate the user before executing the installer, meaning any local or network-accessible process can trigger execution as SYSTEM. ↗
• · The hardcoded MD5 HMAC secret key 'a%qs0t33QgiE6ut^0I&Y' is embedded in the service and used to sign requests; any attacker with knowledge of this key can forge valid authenticated requests. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287