CVE-2023-7241: Privilege Escalation in Webroot Antivirus

The impact of CVE-2023-7241 is significant due to its potential for privilege escalation and data loss. An attacker who successfully exploits this vulnerability can leverage WRSA.EXE to delete critical system files, application data, or even security logs, effectively crippling the system or masking their malicious activity. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to delete protected files bypasses standard security controls, making this a particularly dangerous vulnerability. The scope of impact extends to any system running the affected versions of Webroot Antivirus.

1. Reserved2024-01-25
2. Published2024-05-01
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-7241 is to upgrade Webroot Antivirus to version 9.0.35.17 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider temporarily restricting the permissions of WRSA.EXE to limit its ability to delete files. While not a complete solution, this can reduce the potential impact of exploitation. Monitor system logs for any unusual activity related to WRSA.EXE, particularly file deletion events. After upgrading, confirm the fix by attempting to trigger the vulnerability using a known exploit technique (if available) or by verifying that WRSA.EXE no longer has the ability to delete protected files.