CVE-2020-12431

Katalog CVE

CVSS 6.6 · Medium EPSS 0,55%

Kerentanan Incorrect Permission Assignment for Critical Resource pada splashtop software updater, splashtop streamer. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0).

Rincian

Terbit di NVD

21 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/360042648231-Splashtop-Streamer-version-3-3-... release notes · advisory vendor
• https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer exploit · advisory pihak ketiga