CVE-2024-50590

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”.  Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".

• CWE-250
• CWE-276
• CWE-732

• https://hasomed.de/produkte/elefant/
• https://r.sec-consult.com/hasomed
• http://seclists.org/fulldisclosure/2024/Nov/3

Published

Nov 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50583Whale browser Installer before 3.1.0.0 allows an attacker to…6.3
• CVE-2024-50584An authenticated attacker with the user/role "Poweruser" can…4.4
• CVE-2024-50585Users who click on a malicious link or visit a website under…4.7
• CVE-2024-50588An unauthenticated attacker with access to the local network…9.8
• CVE-2024-50589An unauthenticated attacker with access to the local network…7.5
• CVE-2024-5059Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2024-50591An attacker with local access the to medical office computer…7.8
• CVE-2024-50592An attacker with local access the to medical office computer…7
• CVE-2024-50593An attacker with local access to the medical office computer…7.8
• CVE-2024-50594An integer underflow vulnerability exists in the HTTP server…7.5
• CVE-2024-50595An integer underflow vulnerability exists in the HTTP server…7.5
• CVE-2024-50596An integer underflow vulnerability exists in the HTTP server…7.5