This vulnerability arises from CWE-276: Incorrect Default Permissions in ArubaSign versions prior to 4.6.6. During default installation, the main executable and other program files located in C:\Program Files are assigned overly permissive access rights to the 'Everyone' group. This allows an unprivileged user to replace these files with malicious versions, enabling arbitrary code execution. If the malicious code runs with elevated privileges such as Administrator or SYSTEM, it could lead to privilege escalation and full system compromise. The CVSS 4.0 base score is 8.8, reflecting high impact and exploitability under local attack conditions with user interaction required. No vendor advisory or patch information is currently available.

An attacker with local access and limited privileges could exploit this vulnerability by replacing executable files with malicious ones, leading to arbitrary code execution. If the malicious code executes with elevated privileges, the attacker could escalate privileges and gain full control over the affected system. This compromises system security and data integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user permissions to prevent unauthorized modification of program files in C:\Program Files. Monitor for updates from Aruba regarding patches or configuration changes to address this issue.