CVE-2015-8300

Vulnerability

Polycom BToE Connector versions up to and including 2.3.0 installs the service executable plcmbtoesrv.exe in the default path C:\Program Files (x86)\polycom\polycom btoe connector\ with weak permissions granting Everyone: Full Control [1][2]. This allows any local user to modify or replace the file. The service runs with SYSTEM privileges. The fixed version is 3.0.0, released in March 2015 [1][2].

Exploitation

An attacker must have local access to the Windows system as an unprivileged user. No authentication beyond local logon is required. The attacker simply replaces the legitimate plcmbtoesrv.exe with a malicious executable of their choice. The next time the service starts (e.g., at system boot or by manually restarting the service), the malicious code executes in the context of the SYSTEM account [1][2].

Impact

Successful exploitation grants the attacker arbitrary code execution with SYSTEM privileges, the highest level of access on a Windows host. This results in complete compromise of the local system's confidentiality, integrity, and availability [1][2].

Mitigation

Users should upgrade to Polycom BToE Connector version 3.0.0, which was released in March 2015 and addresses the weak permissions [1][2]. No workaround is described in the available references; the service executable's permissions should be reviewed to restrict modification to trusted administrators only. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.