CVE-2020-12798

Vulnerability

Cellebrite UFED versions 5.0 through 7.5.0.845 implement local operating system policies intended to restrict access to system dialogs and tools such as Run, File Browser, Explorer, Task Manager, and Control Panel. However, a user can bypass these restrictions by leveraging the Wireless Network Connection screen's Certificate-Based Authentication option, which opens a file dialog that is not properly constrained. This allows the user to launch a command prompt from within the restricted desktop environment [2].

Exploitation

An attacker with local access to the UFED device can navigate to the Wireless Network Connection screen and select the Certificate-Based Authentication option. This action triggers a file dialog that is not subject to the same policy restrictions. From this dialog, the attacker can launch a command prompt (cmd.exe). Once a command prompt is obtained, the attacker can use publicly available privilege escalation exploits relevant to the underlying Windows version to elevate privileges [2].

Impact

Successful exploitation allows an attacker to escape the restricted desktop and obtain a command prompt with the privileges of the current user. Using public privilege escalation exploits, the attacker can then gain SYSTEM-level access, leading to full compromise of the device and the ability to execute arbitrary code, access sensitive data, and modify system configurations [2].

Mitigation

The vendor has informed KoreLogic that this vulnerability is not present on devices manufactured at least since 2018. No specific patch version or update has been released for affected devices; users are advised to ensure they are using hardware manufactured after 2018 or contact the vendor for guidance. No workaround is provided in the available references [2].