- The researcher targeted MSI Center due to its widespread preinstallation on MSI laptops and desktops, aiming to find vulnerabilities with broad impact.
- Using the offline installer, they identified that MSI Center is packaged with Inno Setup, extracted files, and decompiled executables, mostly C# and some C++.
- A critical vulnerability was found in MSI's 'Notebook Foundation' service, which exposes a named pipe (MSI_SERVICE_2) accessible to any authenticated user.
- The pipe allows commands like registry manipulation, WMI operations, and running executables as LocalSystem, posing severe security risks like privilege escalation.