RSA NetWitness Endpoint EDR Agent 12.x Incorrect Access Control / Code Execution

RSA NetWitness Endpoint EDR Agent version 12.x suffers from incorrect access controls that allow for code execution. It allows local users to stop the Endpoint Windows agent from sending the events to a SIEM or make the agent run user-supplied commands.

access access control access controls agent code code execution control controls edr endpoint events local netwitness rsa run siem version windows