CVE-2024-5930 is an incorrect permission assignment flaw in the Anti Malware Service of VIPRE Advanced Security, scored 7.8 (High). A local attacker can use a file with weak permissions to run code as SYSTEM. VIPRE released an update, but the advisory names no version.
What's affected
This one sits in the Anti Malware Service rather than the Patch Management Agent. The record says incorrect permissions on a file let a local attacker escalate privileges and run code as SYSTEM. It lists VIPRE Advanced Security 12.0.1.214. The weakness is CWE-732, incorrect permission assignment for a critical resource.
The advisory is ZDI-24-819 (internal tag ZDI-CAN-22345). I could not load it directly, so I am relying on the record and on the fetched sibling advisory ZDI-24-817, which states that VIPRE released an update and gives no version. The VIPRE release notes listed in the record would hold the details, but I could not open that page.
No vendor severity was found, and NVD gives 7.8 High. Not flagged as exploited in the record.
How to check if you're exposed
Read the VIPRE version on each Windows host and check it against the vendor release notes. For the permission issue, inspect the service folders:
icacls "C:\Program Files\VIPRE"
The path is an example of a typical install location, so confirm it on your hosts. Any grant of write or modify access to Users is a finding.
What to do now
- Update VIPRE Advanced Security fleet-wide and verify each host reports the new version.
- Get written confirmation from VIPRE of the build that fixes CVE-2024-5930.
- Audit file permissions on the Anti Malware Service folders and fix any that allow standard users to modify files.
- Alert on changes to files in the product folders.
- Treat CVE-2024-5928 and CVE-2024-5929 in the same maintenance window.
Why it matters
Wrong file permissions are the quietest kind of bug. Nothing crashes and nothing logs an error, but a file that a SYSTEM service trusts can be changed by someone who should not be able to change it.
Three VIPRE issues landed on the same day with the same outcome. That pattern suggests reviewing the installer and service configuration as a whole, not patching one report at a time.
Quick check
Is this reachable remotely?
No. The record says the attacker needs to be able to execute low-privileged code on the target first.
What is the fixed version?
The advisory does not name one. Ask the vendor and record the answer.
Sources
- ZDI-24-819
- VIPRE Windows release notes for 27 February 2024 (listed in the record, I could not load it)
- NVD record for CVE-2024-5930
Last reviewed: 19 October 2026.
