CVE-2019-13208

An attacker who is already authenticated as a local user can exploit improper registry permissions. The "General" registry key grants Full Control to the Users group, allowing any user to modify the "ExternalModule" value. This value contains a semi-colon separated list of DLL filenames that WavesSysSvc64.exe loads via LoadLibraryA at startup. By replacing a referenced DLL name with a path to a malicious DLL, the attacker achieves DLL side-loading when the service (running as LocalSystem) loads the library, resulting in privilege escalation to SYSTEM [ref_id=1].

The vulnerable component is the WavesSysSvc service (WavesSysSvc64.exe 1.9.29.0). The service binary reads DLL names from the registry key named "General" under the Waves MAXX Audio hive, specifically the "ExternalModule" value. The MaxxAudioAPOShell64.dll contains the functions that call RegCreateKeyExA and RegQueryValueExA to retrieve this data.

The advisory does not include a published patch. The recommended remediation is to restrict the permissions on the "General" registry key so that the Users group no longer has Full Control access. Only privileged accounts (such as SYSTEM or Administrators) should be allowed to modify the "ExternalModule" value that controls which DLLs the WavesSysSvc service loads [ref_id=1].