IDrive Cloud Backup Client for Windows enthält eine (Privilege Escalation) Schwachstelle

The vulnerability stems from the id_service.exe process, which runs with elevated privileges and reads data from files under C:\ProgramData\IDrive\. Crucially, these files are read as arguments when launching processes, and standard users can modify them. An attacker can overwrite these files to point to a malicious executable, effectively gaining SYSTEM-level control over the affected machine. This allows for complete compromise, including data theft, installation of malware, and persistent backdoor access. The potential blast radius is significant, as SYSTEM privileges grant access to virtually all resources on the system.

Organizations and individuals using IDrive Cloud Backup Client for Windows, particularly those with less stringent access controls on their systems, are at risk. Shared hosting environments where multiple users have access to the same system are especially vulnerable, as a compromised user account could be leveraged to escalate privileges and compromise the entire system.

• windows / supply-chain:

Get-Acl "C:\ProgramData\IDrive\*" | Select-Object Path, Access

• windows / supply-chain:

Get-Process -Name id_service | Select-Object Path, CommandLine

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing']]] and [EventData[Data[@Name='TargetObject']/text()='C:\ProgramData\IDrive\*']]">

• windows / supply-chain: Check Autoruns for suspicious entries related to id_service.exe or files in C:\ProgramData\IDrive\. • windows / supply-chain: Monitor Windows Defender for alerts related to process creation or file modification within the C:\ProgramData\IDrive\ directory.

1. 2026-03-24Disclosure

   disclosure

1. Reserviert2026-02-05
2. Veröffentlicht2026-03-24
3. Geändert2026-03-25
4. EPSS aktualisiert2026-04-01

The primary mitigation is to upgrade to IDrive Cloud Backup Client for Windows version 7.0.0.63 or later, which addresses the file manipulation vulnerability. If immediate upgrading is not possible, consider restricting write access to the C:\ProgramData\IDrive\ directory to only the id_service.exe process. While less effective, this can limit the attacker's ability to modify the files. Monitor the directory for unexpected file modifications. Implement robust endpoint detection and response (EDR) solutions to detect and block suspicious process execution.