Local DLL Hijacking Vulnerability in SanDisk PrivateAccess Could Lead to Arbitrary Code Execution
CVE-2024-22167

7.9HIGH

Key Information:

Vendor

Sandisk

Status
Privateaccess Windows App
Vendor
CVE Published:
13 March 2024

What is CVE-2024-22167?

A potential DLL hijacking vulnerability exists within the SanDisk PrivateAccess application for Windows. If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the system user. The exploit is limited to local access, requiring an attacker to have access to the user's vault or to gain entry into the user's system. Importantly, this vulnerability cannot spread beyond the local system context, reducing its scope of impact.

Affected Version(s)

PrivateAccess Windows App Windows 0 < 6.4.10

References

https://www.westerndigital.com/support/product-security/w...

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Western Digital would like to thank Alexander Huaman Jaimes for reporting this issue.
.