Local Privilege Escalation in pcvisit service client

pcvisit_service_client.exe in the Windows RemoteHost install can inherit unsafe write permissions, letting a low-privileged local user replace the service binary that later starts as NT AUTHORITY\SYSTEM. Public reporting pegs the affected range at 22.6.22.1329 through 25.12.3.1744 per InfoGuard, while the NVD text says versions after 22.6.22.1329; either way, the fixed version is 25.12.3.1745 released on 2025-12-08.

The vendor/CNA HIGH 8.5 score is fair in a lab because the exploit is simple and the outcome is full local compromise. In enterprise reality it runs hot: this is local-only, requires an attacker who already has code execution or a user session on the box, only matters on Windows systems with pcvisit RemoteHost installed, and often needs a service restart or reboot before the payload fires.

Why this verdict

• Start at 8.5, then cut for post-compromise-only: AV:L + PR:L means the attacker already has code execution or a user session on the host. That prerequisite is an entire earlier compromise stage, so the vendor score overstates urgent fleetwide exposure.
• Cut again for exposed population: this only affects Windows systems running pcvisit RemoteHost, not every Windows endpoint. In most enterprises that is a comparatively narrow, administratively managed subset.
• Trim for execution friction: the attacker still needs the weak ACL to remain in place and usually needs a service restart or reboot before the malicious binary runs as SYSTEM. That is real but not zero friction, especially on monitored hosts.

Why not higher?

There is no unauthenticated or remote entry point here, no userless internet exploit path, no KEV listing, and no public reports of active exploitation campaigns. A vulnerability that starts only after the attacker is already local should not be scored like an edge-service compromise.

Why not lower?

Once the attacker is on the box, the exploit path is straightforward and the outcome is SYSTEM, which is full local compromise. Because pcvisit is remote-support software that may live on admin workstations, unattended support endpoints, or shared servers, the post-exploitation value of a successful privesc is still meaningful.

1. Fix the ACL now on vulnerable binaries — Remove broad Write/Modify rights from pcvisit_service_client.exe and its parent release directory so only trusted administrative principals can change the service binary. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but apply this hardening sooner on shared support workstations, jump hosts, and terminal servers where multiple users can log on.
2. Restrict local logon on RemoteHost systems — Treat Windows systems running unattended remote-support agents as semi-privileged assets and reduce who can log on interactively or via RDP. This does not remove the bug, but it directly attacks the main prerequisite: low-privileged local access.
3. Alert on service-binary tampering — Add file integrity and EDR detections for rename, delete, or write activity involving pcvisit_service_client.exe and for suspicious service-start child processes from the pcvisit install path. This is the best compensating visibility because exploit abuse has to touch disk in a sensitive program directory.
4. Enforce application control — Use WDAC, AppLocker, or equivalent publisher/path rules to block arbitrary unsigned binaries from replacing or executing as the pcvisit service. This materially raises friction against the published PoC and is worth prioritizing anywhere support tooling runs with elevated trust.

Run this on the target Windows host or through your endpoint management tool with local administrator rights so it can read ACLs and file metadata under Program Files. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-cve-2026-0539.ps1. Systems without pcvisit RemoteHost installed return UNKNOWN.

# check-cve-2026-0539.ps1

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-VersionObject {
    param([string]$VersionString)
    try {
        return [version]$VersionString
    } catch {
        return $null
    }
}

function Test-WeakAcl {
    param([string]$Path)

    $weakRights = @('Modify','Write','FullControl')
    $broadPrincipals = @('Everyone','BUILTIN\\Users','Users','Authenticated Users','NT AUTHORITY\\Authenticated Users')

    try {
        $acl = Get-Acl -LiteralPath $Path
    } catch {
        return $null
    }

    foreach ($ace in $acl.Access) {
        $id = [string]$ace.IdentityReference
        if ($broadPrincipals -contains $id) {
            $rights = [string]$ace.FileSystemRights
            foreach ($r in $weakRights) {
                if ($rights -match $r -and $ace.AccessControlType -eq 'Allow') {
                    return $true
                }
            }
        }
    }

    return $false
}

$searchRoots = @(
    "$env:ProgramFiles(x86)\\pcvisit Software AG",
    "$env:ProgramFiles\\pcvisit Software AG"
) | Where-Object { $_ -and (Test-Path $_) }

$targets = @()
foreach ($root in $searchRoots) {
    try {
        $targets += Get-ChildItem -LiteralPath $root -Recurse -Filter 'pcvisit_service_client.exe' -File -ErrorAction SilentlyContinue
    } catch {
        # ignore and continue

    }
}

if (-not $targets -or $targets.Count -eq 0) {
    Write-Output 'UNKNOWN - pcvisit_service_client.exe not found'
    exit 2
}

$minVuln = Get-VersionObject '22.6.22.1329'
$fixedVer = Get-VersionObject '25.12.3.1745'
$foundUnknown = $false

foreach ($file in $targets) {
    $versionString = $null
    try {
        $versionString = $file.VersionInfo.ProductVersion
        if (-not $versionString) { $versionString = $file.VersionInfo.FileVersion }
    } catch {
        $versionString = $null
    }

    $ver = Get-VersionObject $versionString
    if (-not $ver) {
        $foundUnknown = $true
        Write-Output ("UNKNOWN - could not parse version for {0}" -f $file.FullName)
        continue
    }

    $weakAcl = Test-WeakAcl -Path $file.FullName
    if ($null -eq $weakAcl) {
        $foundUnknown = $true
        Write-Output ("UNKNOWN - could not read ACL for {0} (version {1})" -f $file.FullName, $ver)
        continue
    }

    $inRange = ($ver -ge $minVuln -and $ver -lt $fixedVer)

    if ($inRange -and $weakAcl) {
        Write-Output ("VULNERABLE - {0} version {1} has broad write/modify ACLs" -f $file.FullName, $ver)
        exit 1
    }

    if ($ver -ge $fixedVer) {
        Write-Output ("PATCHED - {0} version {1} is at or above fixed version" -f $file.FullName, $ver)
    } elseif ($inRange -and -not $weakAcl) {
        Write-Output ("PATCHED - {0} version {1} is in advisory range but ACLs do not appear broadly writable" -f $file.FullName, $ver)
    } else {
        Write-Output ("UNKNOWN - {0} version {1} is outside expected advisory range" -f $file.FullName, $ver)
        $foundUnknown = $true
    }
}

if ($foundUnknown) {
    exit 2
}

exit 0

Sources

1. InfoGuard Labs advisory
2. pcvisit release notes
3. NVD entry
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. pcvisit Remote-Host overview
8. pcvisit getting started documentation