CVE-2022-40298: 
Homebrew vulnerability analysis and mitigation

Crestron AirMedia for Windows before version 5.5.1.84 contains a privilege escalation vulnerability found in version 4.3.1.39. The vulnerability stems from insecure inherited permissions that allow a low-privileged user to gain SYSTEM level access by initiating a system repair operation (NVD, CVE).

The vulnerability exists due to improper implementation of inherited permissions in the AirMedia Windows Application. When a low-privileged user initiates a repair operation on the system, they can exploit these insecure permissions to obtain a SYSTEM level shell, effectively escalating their privileges (NVD). The vulnerability has been assigned a CVSS v3 base score of 8.8, indicating high severity (AttackerKB).

The successful exploitation of this vulnerability allows a low-privileged user to gain SYSTEM level access, effectively providing them with the highest level of privileges on the affected Windows system. This could potentially allow complete system compromise (NVD).

The vulnerability requires low privileges and no user interaction for exploitation. The attack vector is network-based, making it relatively straightforward to exploit for an attacker with basic access to the system (AttackerKB).

The vulnerability has been fixed in Crestron AirMedia for Windows version 5.5.1.84. Users are advised to upgrade to this version or later to address the security issue (Crestron Advisory).