CVE-2020-17415: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2020-17415 is a local privilege escalation vulnerability discovered in Foxit PhantomPDF Update Service. The vulnerability was disclosed on October 13, 2020, affecting Foxit PhantomPDF installations. This security flaw allows local attackers with low-privileged code execution capabilities to escalate privileges on affected systems (Zero Day Initiative).

The vulnerability exists within the handling of configuration files used by the Foxit PhantomPDF Update Service. The specific issue stems from incorrect permissions set on a resource used by the service. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity local attack vector requiring low privileges and no user interaction (Zero Day Initiative).

An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM, effectively gaining full control over the affected system. This level of access allows the attacker to perform any action with maximum system privileges (Zero Day Initiative).

The vulnerability requires an attacker to first obtain the ability to execute low-privileged code on the target system. Once this prerequisite is met, the attacker can exploit the incorrect permission settings on the configuration files to escalate privileges (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their Foxit PhantomPDF installations to the latest version available through the vendor's security bulletin (Zero Day Initiative, NVD).