Local Privilege Escalation Vulnerability in AVG TuneUp by AVG Technologies

CVE-2024-13960

What is CVE-2024-13960?

A security issue has been identified in AVG TuneUp for Windows 10, where a local privilege escalation vulnerability exists due to improper handling of symbolic links within the TuneUp service. This flaw enables an attacker with local access to escalate their privileges and execute arbitrary code in the context of the SYSTEM account. Exploiting this vulnerability involves creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack, which can lead to significant security breaches. Users are urged to secure their systems by updating to the latest version provided by AVG Technologies.

References