CVE-2020-27992

CVE-2020-27992 describes a local privilege escalation vulnerability in Dr.Fone version 3.0.0, where the DriverInstall.exe component within the Dr.Fone installation directory has overly permissive "Full Control" permissions for standard users. This allows a local attacker to replace the legitimate executable with a malicious one, leading to high impact on confidentiality, integrity, and availability. Rated with a CVSS score of 7.8 (HIGH), this vulnerability is relatively easy to exploit locally with low attack complexity and no user interaction required. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential for a local attacker to gain elevated privileges remains.