CVE-2023-6080 is a high severity (CVSS 7.8 in the record) local privilege escalation in the Lakeside Software SysTrack LsiAgent installer, version 10.7.8 for Windows. It allows a standard user to reach SYSTEM. Mandiant, which reported it as MNDT-2024-0009, says the issue was fixed in version 11.0.
What's affected
- Product: Lakeside Software SysTrack LsiAgent Installer for Windows.
- Affected: version 10.7.8, per Mandiant.
- Fixed: version 11.0, per Mandiant.
- Severity: 7.8 High in the NVD record. Mandiant scores it 8.8 using a vector with changed scope (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The two sources differ.
- Credit: Mandiant, in its vulnerability disclosure repository.
How to check if you're exposed
On Windows machines that run SysTrack, find the installed agent and its version. PowerShell can list it:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -like "*SysTrack*" } |
Select-Object DisplayName, DisplayVersion
An installer or agent at 10.7.8 is the affected release. Keep the original MSI files in mind too, because the issue sits in the installer, and old installers kept in software shares are still risky to run.
What to do now
- Upgrade SysTrack to version 11.0 or later, following Lakeside guidance.
- Remove old 10.7.8 installers from shared software folders and deployment tools, so nobody reinstalls the affected version.
- Limit ordinary users' ability to trigger Windows Installer repair on managed machines, where your policy allows.
- Check which machines have the agent, and record their versions.
- Treat endpoints that held a standard user session from an untrusted person as higher priority.
Why it matters
Mandiant describes what happens when a standard user starts a repair operation on the installed package. Windows Installer copies an executable into a folder the user controls, waits briefly, then runs it as SYSTEM. Because the user can replace the file during that gap, the user can make SYSTEM run something else. The record lists CWE-379, creation of a temporary file in a directory with insecure permissions.
That pattern is common in installers: a privileged process trusts a location that a low privilege user can write. Mandiant rates exploitability as high, saying any authenticated local user can do it. It needs local access, so it is not a remote entry point, but it helps an attacker who already has a normal account. The record does not list this CVE as known exploited. The fix is a newer version, and the clean-up is removing old installers.
Quick check
Does this affect machines that already finished installing?
The issue is in the installer's repair operation, so a machine with the affected package installed is exposed to a local user who can trigger a repair. Upgrading to 11.0 removes the problem.
Sources
Last reviewed: 19 October 2026.
