{"id":"CVE-2024-50592","aliases":["EUVD-2024-44969","GHSA-fh7h-qp2r-qp8p"],"status":"published","title":"Local Privilege Escalation via Race Condition","description":"An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process. When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included. The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\".","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00175,"percentile":0.07053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-367"],"published":"2024-11-08T12:15:25Z","modified":"2026-06-17T08:04:46Z","products":[{"vendor":"hasomed","product":"elefant software updater"},{"vendor":"hasomed","product":"elefant_software_updater"}],"references":[{"url":"https://r.sec-consult.com/hasomed","tags":["third-party-advisory"]},{"url":"https://hasomed.de/produkte/elefant/","tags":["patch"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50592"},{"url":"https://hasomed.de/produkte/elefant"},{"url":"https://github.com/advisories/GHSA-fh7h-qp2r-qp8p"}],"sources":{"cve":[{"id":"CVE-2024-50592","title":"Local Privilege Escalation via Race Condition","description":"An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process. When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included. The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\".","status":"published","published":"2024-11-08T12:15:25.835Z","modified":"2025-11-03T22:28:29.966Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-44969","description":"An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process. When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included. The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\".","status":"published","published":"2024-11-08T12:15:25Z","modified":"2025-11-03T22:28:29Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-fh7h-qp2r-qp8p","title":"An attacker with local access the to medical office computer can \nescalate his Windows user...","description":"An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process. When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included. The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\".","status":"published","published":"2024-11-08T15:31:12Z","modified":"2025-11-04T00:31:59Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:04:30.147215Z"}],"nvd":[{"id":"CVE-2024-50592","description":"An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process. When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included. The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\".","status":"published","published":"2024-11-08T13:15:03.67Z","modified":"2026-06-17T08:04:46.087Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:10:36.560164Z"}]}}