The CVSS 5.4 score for this uncontrolled search path vulnerability in EquiTriton obscures a more dangerous reality. While the rating correctly reflects no kernel-level compromise, the 'high' local CIA impact paired with 'none' system impact creates a false signal of containment that defenders should not accept at face value.
This vulnerability achieves code execution in the context of whichever user launches the affected application. If that user has elevated privileges within Windows — which is common for administrators, developers, or IT staff — the attacker gains code execution in a privileged session without needing kernel access. The 'none' system impact rating tells you this isn't a kernel exploit, but it does not tell you that the attacker is now positioned on the right side of the trust boundary for lateral movement, token manipulation, or credential relay. From a privileged user's session, adjacent systems and resources are reachable through legitimate channels that do not trigger system-level alerts.
The 'passive user interaction' requirement means the victim must launch the application from a directory the attacker controls — typically requiring filesystem write access to a location the user will navigate to. This is not a trivial precondition, but it is a far weaker constraint than a traditional remote or network-based exploit. An attacker who has established any foothold in the user's environment (through phishing, credential theft, or another initial access vector) can satisfy this requirement and weaponize this vulnerability as the next stage.
The description's reference to an 'unprivileged software adversary with a privileged user' suggests this vulnerability was originally documented as a post-exploitation tool — a stepping stone between an established unprivileged context and a privileged session, not a standalone initial access vector. This framing has likely been lost in externalization, leaving the CVE with an 'escalation of privilege' label that conflates lateral movement within a user session with actual privilege escalation to SYSTEM or kernel-level access.
Defenders should treat this as a medium-severity vulnerability with a high-consequence blast radius in environments where privileged users run EquiTriton. Prioritize patching, but also audit for token manipulation and lateral movement activity around any system running this software. The CVSS score will not tell you this; the score was designed for standalone vulnerabilities, not chained attack requirements.