A vulnerability in Windows 10's Update Assistant allows malicious users to run code with SYSTEM privileges.
The vulnerability (elevation of privilege) is documented in CVE-2019-1378, where Microsoft explains that an attacker can create an account with full user rights, ultimately gaining access to install malware to take control of the device.
"A privilege vulnerability exists in the Windows 10 Update Assistant in the way it manages permissions," Microsoft says
“A locally authenticated attacker could run malicious code with elevated system privileges. After successfully exploiting the vulnerability, the attacker could install programs, view, change, or delete data, and create new accounts with full user rights.”
The flaw was discovered and reported to Microsoft by Jimmy Bayne and exists in the Windows 10 Update Assistant regardless of the version of Windows 10 you have installed.
As reported by Bleepingcomputer, some computers are starting to run the Windows 10 Update Assistant after installing the KB4023814 update. However, this update only applies to devices running Windows 10 version 1803 (April 2018 Update) or later and is supposed to prepare the ground for the upgrade to Windows 10 version 1903 (May 2019 Update).
On the other hand, devices running Update Assistant on Windows 10 version 1903 are also vulnerable to attacks if the update was installed manually.
Microsoft has already released a new version of Update Assistant to address the vulnerability and recommends that all users install it as soon as possible. The only way to fix the flaw is to manually install this new version, at least until the patch is included in a cumulative update. Of course, you will have to uninstall the older version:
Microsoft says the flaw has not been publicly disclosed, so no exploit is available (yet). Regardless, you should update your system.
