📄 Description (English)
ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.
🤖 AI Executive Summary
CVE-2019-25274 is a local privilege escalation vulnerability in ProShow Producer 9.0.3797 affecting the ScsiAccess service through an unquoted service path. Attackers with local access can inject malicious executables to execute arbitrary code with LocalSystem privileges. While no public exploit exists, the vulnerability poses significant risk to organizations using this software, particularly in media production and content creation environments.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 27, 2026 00:55
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi media production companies, broadcasting organizations, and government media entities using ProShow Producer. Secondary impact on educational institutions with media departments and corporate communications teams. Risk is localized to systems where ProShow Producer is installed; however, compromised systems could serve as pivot points for lateral movement in organizational networks. Government and private sector media production facilities are most at risk.
🏢 Affected Saudi Sectors
Media and Broadcasting
Government Communications
Education (Media Departments)
Corporate Communications
Entertainment Production
🎯 MITRE ATT&CK Techniques
T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1134.003 - Access Token Manipulation: Make and Impersonate Token
T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt
T1574.008 - Hijack Execution Flow: DLL Search Order Hijacking
T1053.005 - Scheduled Task/Job: Scheduled Task
⚖️ Saudi Risk Score (AI)
6.2
/ 10.0
🔧 Remediation Steps (English)
1. IMMEDIATE ACTIONS:
- Identify all systems running ProShow Producer 9.0.3797 across the organization
- Restrict local access to affected systems through access controls
- Monitor service startup logs for suspicious executable injections
2. PATCHING GUIDANCE:
- Upgrade ProShow Producer to version 9.0.3798 or later immediately
- Verify patch installation by checking service binary path configuration
- Test functionality post-patch in non-production environment first
3. COMPENSATING CONTROLS (if immediate patching not possible):
- Implement file system monitoring on service directories (C:\Program Files\ProShow Producer\)
- Use AppLocker or Windows Defender Application Control to restrict executable execution
- Disable ScsiAccess service if not required for operations
- Apply principle of least privilege to user accounts
4. DETECTION RULES:
- Monitor Event Viewer for Service Control Manager (Event ID 7045) for new service creation
- Alert on file creation in Program Files directories with suspicious names
- Track registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\ScsiAccess
- Monitor for processes spawned by svchost.exe with unusual parent-child relationships
🔧 خطوات المعالجة (العربية)
1. الإجراءات الفورية:
- تحديد جميع الأنظمة التي تقوم بتشغيل ProShow Producer 9.0.3797 في المنظمة
- تقييد الوصول المحلي للأنظمة المتأثرة من خلال عناصر التحكم في الوصول
- مراقبة سجلات بدء الخدمة للحقن المريب للملفات التنفيذية
2. إرشادات التصحيح:
- ترقية ProShow Producer إلى الإصدار 9.0.3798 أو أحدث على الفور
- التحقق من تثبيت التصحيح بفحص تكوين مسار الملف الثنائي للخدمة
- اختبار الوظيفة بعد التصحيح في بيئة غير الإنتاج أولاً
3. عناصر التحكم البديلة (إذا لم يكن التصحيح الفوري ممكناً):
- تنفيذ مراقبة نظام الملفات في دلائل الخدمة
- استخدام AppLocker أو Windows Defender Application Control لتقييد تنفيذ الملفات
- تعطيل خدمة ScsiAccess إذا لم تكن مطلوبة للعمليات
- تطبيق مبدأ أقل امتياز على حسابات المستخدمين
4. قواعد الكشف:
- مراقبة Event Viewer لمدير التحكم في الخدمة للخدمات الجديدة
- التنبيه على إنشاء الملفات في دلائل Program Files بأسماء مريبة
- تتبع تعديلات السجل على مفاتيح الخدمة
- مراقبة العمليات التي تم إطلاقها بواسطة svchost.exe بعلاقات أب-طفل غير عادية
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.8.1.1 - User access management
A.12.2.1 - Change management procedures
A.12.6.1 - Management of technical vulnerabilities
🔵 SAMA CSF
ID.AM-2 - Software inventory and management
PR.AC-1 - Access control policy and procedures
PR.PT-2 - Removable media protection
DE.CM-8 - Vulnerability scans
🟡 ISO 27001:2022
A.12.6.1 - Management of technical vulnerabilities
A.14.2.1 - Secure development policy
A.12.2.1 - Change management
A.5.1.1 - Information security policies