CVE-2024-47856

When the path to a service executable or shortcut contains spaces and is not enclosed in quotes, Windows attempts to sequentially resolve each segment of the path as a separate executable file. An attacker can place a malicious executable file in a directory higher than the target program, and Windows will execute that file instead of the legitimate one. This technique (unquoted service path) allows for takeover of a process typically executed with system privileges.

An attacker can execute arbitrary code in the context of a privileged process (e.g., SYSTEM), which in practice means complete takeover of the system, including the ability to perform privilege escalation, steal authentication credentials, and install malicious software.

RSA Authentication Agent for Windows should be updated to version 7.4.7 or later. The update package is available in the vendor references (community.rsa.com). Until the patch is deployed, it is recommended to restrict local system access exclusively to authorized users and monitor system directories for unexpected executable files.

RSA Authentication Agent for Windows versions prior to 7.4.7