CYRISMA Sensor Version 2.5 for Windows: A Technical Deep-Dive

Authored by Packetlabs ethical hackers Eric Salario and Chance Pearson.

During our Assumed Breached Penetration Testing (ABPT) engagements, we are typically provided access to a user workstation. The client decides which identity will be mimicked, but usually it will be a user without local administrator access to their own workstations. As a result, identifying local privilege escalation paths sometimes becomes necessary.

While escalating privileges on the assumed-breached system isn’t always required, we found it to be highly needed in one of our engagements as part of an attack path. This is where we discovered a couple of privilege escalation opportunities:

• Insecure folder permissions leading to a service binary hijacking

• DLL hijacking

These techniques are hardly groundbreaking. In fact, it’s one of the oldest tricks in the Windows privilege escalation playbook. Yet, during a recent engagement, we encountered these issues in an application we didn’t expect: a cyber risk management product designed to improve security posture.

Insecure Folder and File Permissions (CVE-2025-57624)

CYRISMA Sensor Version 2.5 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by the Cyrisma_Agent service when it starts.

To reproduce this issue, download and install Cyrisma_Setup.exe (this needs a demo or a valid license from the vendor). 

Installation Behavior

During installation of the CYRISMA Agent, it performs checks then uses a provided agent key and instance URL to validate licensing and initiate pairing with the CYRISMA cloud.

Interestingly, the agent is then installed as a Windows service Cyrisma_Agent with binary pointing to srvany.exe, and file permissions are modified to remove access rights for the BUILTIN\Users and Authenticated Users groups from this service binary, but not for the rest of the stuff within the directory.

Abusing The Issue

When the permissions on all files and folders inside C:\CYRISMA_Agent is reviewed,  Authenticated Users were observed to have Modify, Read & Execute, List Folder Contents, Read, and Write permissions on the folder and its contents, except for srvany.exe located at C:\CYRISMA_Agent\Install, where access for BUILTIN\Users and Authenticated Users has been explicitly removed during installation.

A Windows service Cyrisma_Agent that runs as Local System (NT AUTHORITY\SYSTEM) is created upon installation. This runs the service binary C:\CYRISMA_Agent\Install\srvany.exe. Low privilege users don’t have access to this service and to the service binary.

Using a tool like Sysinternals' Procmon, it was observed that srvany.exe spawns DataSpotliteAgent.exe when the Cyrisma_Agent service starts.

This behavior can be abused by replacing DataSpotliteAgent.exe with an arbitrary binary of your choosing. Upon service restart, the binary will be executed with SYSTEM privileges.

Watch the full demo video today.

DLL Hijacking  (CVE-2025-57625)

DLL hijacking vulnerability in CYRISMA Agent version 2.5 allows local users to escalate privileges and execute arbitrary code via multiple DLLs.

Abusing the Issue

Using Sysinternals' Procmon, DLLs that DataSpotliteAgent.exe was loading during runtime at the same directory, which doesn't exist, were enumerated.

In this case, we chose to hijack one of the DLLs CRYPTBASE.dll.

Note that the issue exists regardless of the directory. For instance, the DataSpotliteAgent.exe was moved to the Desktop, and it's calling the DLLs in its current directory.

Learn more via our demo video.

Disclosure Timeline

• 2025-04-23: Discovery

• 2024-04-24: Initial vendor notification

• 2024-05-01: Initial vendor response

• 2025-05-13: Release of fixed version/patch

• 2025-07-07: Public disclosure

Conclusion

Even mature security products can introduce basic Windows privilege-escalation risks when installation paths, file permissions, or DLL loading aren’t hardened. Our engagement shows that simple checks such as folder ACLs and safe DLL search paths catch high-impact issues before attackers do. 

Thanks to CYRISMA for acknowledging and fixing the vulnerability quickly! The fixed version (CYRISMA Sensor Version 444)  has been pushed to their customers.