CVE-2019-17202

Vulnerability

FastTrack Admin By Request 6.1.0.0 uses a simple challenge-response mechanism for users who are not allowed to elevate privileges via group policies. The PIN response algorithm depends only on the customer ID and device name, which are available to all users on the system. This allows anyone to compute the correct PIN without any special permissions or secrets.

The affected version is 6.1.0.0. No newer versions are named in the available references, but the vendor has since released multiple newer versions (up to 8.7) according to the release notes [1].

Exploitation

An attacker needs to be a local user on the system. They can obtain the customer ID and device name from the client software interface or configuration. Using the known simple algorithm, they compute the correct PIN response. When elevation is requested, the system prompts for a PIN; the attacker enters the computed PIN and gains Administrator privileges.

Impact

A non-privileged user can elevate to full Administrator rights, bypassing the intended group policy restrictions. This leads to complete compromise of the local system, including the ability to install software, modify system files, create or delete users, and access all data on the machine.

Mitigation

According to the vendor's release notes [1], Admin By Request has been updated through multiple versions, with the latest being 8.7 (February 2026). Any user still running 6.1.0.0 should upgrade to the latest available version. No specific release date for a security fix is given for this CVE. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.