Horizon Alert
Summary of the vulnerability and why it matters
The Justice AV Solutions Viewer installation package contains a compromised binary. When executed, this compromised component allows unauthorized remote attackers to run PowerShell commands. This could lead to significant business risk through the execution of malicious scripts.
- Vulnerable: Justice AV Solutions Viewer installer
- Flaw: Malicious binary included
- Impact: Unauthorized command execution
Attack Path
How an attacker could exploit the issue
This vulnerability involves a malicious binary included in the Justice AV Solutions Viewer Setup. A remote, privileged attacker can exploit this to run unauthorized PowerShell commands. This could lead to compromised systems and data, posing a significant business risk.
- Exposure requires privileged access.
- Attacker uses a malicious binary.
- Trigger results in unauthorized commands.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability involves a malicious binary embedded within the Justice AV Solutions Viewer setup. A threat actor with privileged access could leverage this to execute unauthorized PowerShell commands. The potential impact includes unauthorized system control and data exfiltration.
- High attacker skill level likely
- Privileged access required
- High business risk or urgency
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
A security vulnerability has been identified in Justice AV Solutions Viewer, which, when exploited, could allow a threat actor to execute unauthorized PowerShell commands remotely. This impacts organizations using the affected software, potentially compromising system integrity and data confidentiality. The vulnerability is associated with a malicious binary embedded within the installer, signed with an unexpected authenticode signature.
- Identify exposed installations of the Justice AV Solutions Viewer.
- Reduce exposure by isolating affected systems or discontinuing product use.
- Apply vendor-provided fixes and validate successful implementation.
- Monitor for related security incidents.
