RazerCentralSerivce Unsafe Named Pipe Permission Escalation of Privilege Vulnerability
CVE-2023-3514

7.8HIGH

Key Information:

Vendor

Razer

Status
Razer Central
Vendor
CVE Published:
14 July 2023

What is CVE-2023-3514?

An improper privilege control vulnerability exists in the RazerCentralService on Windows, specifically affecting RazerCentral versions up to and including 7.11.0.558. This flaw allows a local attacker to escalate privileges to SYSTEM level by interacting with a named pipe as a low-privileged user. By executing specific commands like 'AddModule' or 'UninstallModules', the attacker can execute arbitrary files, thereby compromising system integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Razer Central Windows 0 <= 7.11.0.558

References

https://starlabs.sg/advisories/23/23-3514/
third-party-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phan Thanh Duy (@PTDuy) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
JSON
.