CVE-2026-1995: 权限提升漏洞 in IDrive Cloud Backup Client

该漏洞的影响非常严重，攻击者可以利用它在受影响的系统上获得完全控制权。攻击者可以执行恶意软件、窃取敏感数据、修改系统配置，甚至完全接管受影响的计算机。由于 id_service.exe 进程以 SYSTEM 权限运行，攻击者可以绕过许多安全控制，从而实现持久性访问。该漏洞类似于其他利用文件路径篡改来提升权限的攻击模式，可能导致数据泄露和系统瘫痪。

Organizations and individuals using IDrive Cloud Backup Client for Windows, particularly those with less stringent access controls on their systems, are at risk. Shared hosting environments where multiple users have access to the same system are especially vulnerable, as a compromised user account could be leveraged to escalate privileges and compromise the entire system.

• windows / supply-chain:

Get-Acl "C:\ProgramData\IDrive\*" | Select-Object Path, Access

• windows / supply-chain:

Get-Process -Name id_service | Select-Object Path, CommandLine

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing']]] and [EventData[Data[@Name='TargetObject']/text()='C:\ProgramData\IDrive\*']]">

• windows / supply-chain: Check Autoruns for suspicious entries related to id_service.exe or files in C:\ProgramData\IDrive\. • windows / supply-chain: Monitor Windows Defender for alerts related to process creation or file modification within the C:\ProgramData\IDrive\ directory.

1. 2026-03-24Disclosure

   disclosure

1. 已保留2026-02-05
2. 发布日期2026-03-24
3. 修改日期2026-03-25
4. EPSS 更新日期2026-04-01

为了缓解 CVE-2026-1995 的风险，首要措施是立即更新 IDrive Cloud Backup Client for Windows 到 7.0.0.63 或更高版本。如果无法立即更新，可以考虑限制对 C:\ProgramData\IDrive\ 目录的访问权限，仅允许 idservice.exe 进程进行读写操作。此外，实施严格的文件完整性监控，检测任何未经授权的修改。可以使用 Windows Defender 进行实时监控，并配置相应的警报规则。更新后，请验证 idservice.exe 进程是否以预期权限运行。