AI analysis
ZDI-disclosed vulnerability (ZDI-CAN-29220) in the RAS RDP Backend Service of the Parallels RAS Client exposes a dangerous function (CWE-749), allowing a local attacker to escalate privileges. To trigger it, an attacker must already be able to execute low-privileged code on the target machine, after which the exposed function of the service can be abused to run arbitrary code. Successful exploitation yields code execution in the context of SYSTEM, the highest local privilege on Windows, giving the attacker full control of the host. Organizations running the Parallels Remote Application Server (RAS) Client component are affected. As of disclosure, there is no known public proof-of-concept, EPSS is 0.1%, and the flaw is not in the CISA KEV catalog, indicating no confirmed exploitation in the wild.
What to do: Apply the patched Parallels RAS Client build referenced in ZDI-26-554 and Parallels' advisory (specific fixed version numbers are not included in the available disclosure data). Inventory endpoints where the RAS RDP Backend Service is installed and running as SYSTEM, and prioritize hosts where low-privileged or untrusted users can execute code. Until patched, restrict local code execution on RAS client hosts and monitor the service for anomalous child-process or privilege activity.
Affected
| Parallels RAS Client (Remote Application Server) — RAS RDP Backend Service | — |
Estimated exposure
unknown; plausibly on the order of tens of thousands of enterprise endpoints running the RAS client — Parallels RAS is a low-market-share enterprise VDI/remote-application product with no published install counts or internet-exposure scan data, so the estimate assumes only that its relatively small customer base deploys the client to many…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.