{"uuid": "0162a568-1591-4e91-92e9-550f22cf0b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35313", "type": "seen", "source": "https://t.me/hacking_Attack/24540", "content": "Exploit CollectorTotalAV 5.15.69 Unquoted Service Path \n\n\nTotalAV version 5.15.69 suffers from an unquoted service path vulnerability.\n\nMD5 | f60e46c8d3377f891ee188835e438cd2\n\nDownload\n\n\n\n# Exploit Title: TotalAV - Unquoted Service Path\n# Date: 2021-09-22\n# Exploit Author: Andrea Intilangelo\n# Vendor Homepage: https://www.totalav.com\n# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe\n# Version: 5.15.69\n# Tested on: Windows 10 Pro 20H2 and 21H1 x64\n# CVE: CVE-2021-35313\n\nThe PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service\nservices from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a\nuser to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible\nto place executable(s) following the path of the unquoted string.\n\nAffected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:\n\nPC Security Management Service       SecurityService   C:\\Program Files (x86)\\TotalAV\\SecurityService.exe       Auto\nPC Security Management Monitoring Service   SecurityServiceMonitor  C:\\Program Files (x86)\\TotalAV\\SecurityService.exe --monitor     Auto\nAnti-Malware SDK Protected Service    AMSProtectedService   C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe   Auto\n\nC:\\Users\\user>sc qc SecurityService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE     : 1   NORMAL\nNOME_PERCORSO_BINARIO    : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Service\nDIPENDENZE      :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc SecurityServiceMonitor\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: SecurityServiceMonitor\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files(x86)\\TotalAV\\SecurityService.exe --monitor\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : PC Security Management Monitoring Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\nC:\\Users\\user>sc qc AMSProtectedService\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\n\nNOME_SERVIZIO: AMSProtectedService\nTIPO         : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO       : 2   AUTO_START\nCONTROLLO_ERRORE    : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files (x86)\\TotalAV\\savapi\\elam_ppl\\amsprotectedservice.exe\nGRUPPO_ORDINE_CARICAMENTO :\nTAG         : 0\nNOME_VISUALIZZATO     : Anti-Malware SDK Protected Service\nDIPENDENZE       :\nSERVICE_START_NAME : LocalSystem\n\n\n\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:50.230038Z"}