CVE-2024-58288 HIGH

CVE-2024-58288: Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation

Vendor Genexus
Product Genexus Protection Server
Weakness CWE-428
Published December 11, 2025
Last update December 18, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.

Key dates

02Disclosure timeline

December 11, 2025 CVE published
December 18, 2025 Record updated