CVE-2019-10679

An unprivileged local user who is a member of the Authenticated Users group can write to the directory C:\Program Files (x86)\Thomson Reuters\Eikon [ref_id=1]. Because the service runs with SYSTEM privileges, replacing the executable with a malicious binary causes the operating system to execute the attacker's code at the next service start, resulting in full privilege escalation [ref_id=1]. No network access or special authentication beyond a valid local logon is required.

The vulnerable component is the service executable file located in C:\Program Files (x86)\Thomson Reuters\Eikon [ref_id=1]. The advisory does not name a specific executable filename or function; the defect is in the file-system ACLs applied to the entire installation directory, which grant write access to the Authenticated Users group [ref_id=1].

The advisory states that the vendor did not release a patch and did not respond to follow-up requests [ref_id=1]. The recommended remediation is to restrict write permissions on the Eikon directory to administrative users only, and to run the application on a separate system accessible via RDP rather than on a shared domain-joined workstation [ref_id=1].