Privilege Escalation in Razer Synapse Software by Razer
CVE-2017-11652

8.4HIGH

Key Information:

Vendor

Razer

Status
Synapse
Vendor
CVE Published:
18 August 2017

What is CVE-2017-11652?

Razer Synapse prior to version 2.20.15.1104 suffers from a weakness in the permissions associated with its CrashReporter directory. This vulnerability can be exploited by local users to increase their privileges through the use of a malicious dbghelp.dll file. By placing this rogue library in the specified directory, an attacker can gain unauthorized access to system resources, potentially leading to a full compromise of the system. It is crucial for users of Razer Synapse to update their software to the latest version to mitigate this risk.

References

http://packetstormsecurity.com/files/143516/Razer-Synapse...
x_refsource_MISC

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.