Exposed dangerous function enables SYSTEM privilege escalation in Parallels RAS Client

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.

• The CVE record marks Parallels RAS Client version 21.0.26296 as affected.
• ZDI states that the issue is fixed in version 21.2.
• The status of parallel release branches or other versions is not fully established by the available evidence. Do not infer that every later version or separate branch is unaffected solely from the stated fix.

Parallels RAS Client exposes a dangerous function in the RAS RDP Backend Service, matching CWE-749. The attacker must first obtain the ability to run low-privileged code on the target system, then use the exposed function to escalate privileges. The supplied attack characteristics indicate local reachability and no user interaction. The exact function name, invocation interface, attacker-controlled parameters, and authorization failure are not disclosed in the available evidence. Successful exploitation allows arbitrary code execution in the SYSTEM context; the evidence does not establish a remote attack path or cross-host propagation mechanism.

Reachability is local, and the attacker must already be able to execute low-privileged code on the affected host. The supplied attack characteristics indicate low complexity, low privileges, and no user interaction. The normalized record marks public_exploit as false and does not confirm known exploitation. GCVE-hosted CISA enrichment records Exploitation: none and Automatable: no; this is a scoped status assessment and not proof that exploitation is impossible. No payload, exploit sequence, or public exploit is provided in the evidence reviewed.

The confirmed technical outcome is local privilege escalation followed by arbitrary code execution in the SYSTEM context on the affected host. That level of access could enable control of sensitive operating-system actions, local data access or modification, configuration changes, and service disruption. Because the flaw requires the attacker to begin with low-privileged code execution, it does not itself provide initial access to the host. The available evidence also does not show that exploitation changes the security scope to another system or propagates automatically.

Successful exploitation can turn a low-privilege foothold on a workstation or server running RAS Client into SYSTEM-level control. This could allow access to data unavailable to the initial account, modification of local configuration or software, and disruption of services on the host. The risk is concentrated on systems where RAS Client is installed and untrusted low-privileged code can execute locally. The vulnerability does not by itself establish a remote compromise, data theft scenario, or network-wide propagation path.

1. Upgrade Parallels RAS Client to version 21.2, which ZDI identifies as fixing the issue.
2. Reconcile the upgrade across all systems running RAS Client and verify each release branch separately rather than relying only on the product name.
3. If the fixed release cannot be deployed immediately, restrict the ability to run untrusted low-privileged code on systems with RAS Client and increase endpoint monitoring. This is temporary risk reduction, not a vendor-confirmed workaround.
4. No separate mitigation or component-disable procedure is confirmed in the available evidence.

1. Inventory hosts with Parallels RAS Client installed and compare their versions with the affected release recorded for this issue.
2. Confirm whether RAS RDP Backend Service is present and active on identified hosts.
3. Prioritize endpoint telemetry review on affected installations for unusual local process activity around the service and unexpected changes performed by SYSTEM. These are precautionary monitoring checks, not confirmed indicators.
4. No specific function name, log signature, or indicator of compromise is disclosed. Absence of suspicious logs does not prove that a host is safe.