Local Privilege Escalation Vulnerability in Thales SafeNet Sentinel HASP LDK Installer
CVE-2024-0197

7.8HIGH

Key Information:

Vendor

Thales

Status
Sentinel Hasp Ldk
Vendor
CVE Published:
27 February 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-0197?

A security flaw exists within the installation process of Thales SafeNet Sentinel HASP LDK versions prior to 9.16, running on Windows operating systems. This vulnerability enables an attacker, who has local access to the system, to escalate their privileges, potentially granting them unauthorized control over the affected system. This issue raises significant security concerns, as it may allow malicious actors to manipulate system functions or gain access to sensitive information.

Affected Version(s)

Sentinel HASP LDK Windows 0 < 9.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0197-POC
Created by ewilded

References

https://supportportal.thalesgroup.com

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Julian Horoszkiewicz (Eviden Red Team)
.