cbcvebase.
CVE-2021-44595
published 2022-04-29

CVE-2021-44595: Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the…

PriorityP272high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
20.98%
97.3th percentile
Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM privileges.

Affected

1 ranges
VendorProductVersion rangeFixed in
wondersharedr.fone——

Detection & IOCsextracted from sources · hover to see the quote

processElevationService.exe↗
port12345↗
commandclient.call('system_s','powershell',param)↗
urlhttps://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1↗
urlhttps://download.wondershare.net/drfone_full4008.exe↗
  • →Monitor for msgpack-RPC connections to TCP port 12345 on hosts running ElevationService.exe; unexpected inbound connections to this port from non-privileged user processes indicate exploitation attempts. ↗
  • →Alert on ElevationService.exe spawning child processes (e.g., powershell.exe) as SYSTEM, especially when initiated by a low-privileged user context. ↗
  • →Detect the RPC method name 'system_s' being called over msgpack-RPC on port 12345; this is the specific vulnerable method exposed by ElevationService.exe. ↗
  • →Hunt for PowerShell IEX/IWR invocations downloading Invoke-ConPtyShell.ps1 from GitHub, which is the payload delivery mechanism used in the public exploit. ↗
  • ·The exploit targets a hardcoded port (12345) for the ElevationService.exe RPC listener; verify this port is consistent across Dr.Fone installations before deploying port-based detections. ↗
  • ·The public exploit was tested on Windows 10 against Dr.Fone up to version 12.0.7; applicability to other Windows versions or later Dr.Fone releases should be validated. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.