Privilege Escalation Flaw in Dragon Center by Micro-Star MSI
CVE-2020-13149

7.8HIGH

Key Information:

Vendor

Msi

Status
Dragon Center
Vendor
CVE Published:
18 May 2020

What is CVE-2020-13149?

The Dragon Center application, used by Micro-Star MSI Gaming laptops, suffers from a vulnerability due to weak permissions on the '%PROGRAMDATA%\MSI\Dragon Center' folder. This issue affects versions prior to 2.6.2003.2401 and allows local authenticated users to overwrite critical system files, potentially leading to escalated privileges. Attackers can exploit this flaw by modifying the Recommended App binary within App.json or by setting up an RPC Control directory using parts of the '%PROGRAMDATA%' path.

References

https://github.com/rishaldwivedi/Public_Disclosure/blob/m...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.