The servereye Windows Agent (Sensorhub) versions 20.15 and earlier contain a local privilege escalation vulnerability due to insecure permissions on the %ProgramData%\ServerEye3\update\ directory. The SE3Recovery service, running as SYSTEM, watches for a trigger file named "update_available" in this directory. A local standard user can create this trigger file and specify a path to a directory containing malicious JSON instructions. The service then runs UpdaterAction.exe with SYSTEM privileges, which parses these instructions and performs unvalidated file copies from user-controlled sources to protected system locations, such as overwriting service binaries. This leads to full system compromise as the overwritten binaries are restarted with SYSTEM privileges.

An attacker with local standard user access can escalate privileges to SYSTEM by exploiting insecure directory permissions to execute arbitrary code with SYSTEM rights. This results in complete system compromise, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the %ProgramData%\ServerEye3\update\ directory to prevent creation of unauthorized trigger files. Monitor for suspicious files named "update_available" in this directory and consider disabling or restricting the SE3Recovery service if feasible.