splashtop mirroring360 receiver, splashtop mirroring360 sender, splashtop +2 lainnya
CVSS 7.8 · High EPSS 0,18%
Kerentanan Creation of Temporary File in Directory with Insecure Permissions pada splashtop mirroring360 receiver, splashtop mirroring360 sender +3 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.
The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| splashtop | mirroring360 receiver | Semua versi sebelum 2.4.0.1 |
| splashtop | mirroring360 sender | Semua versi sebelum 1.3.0.0 |
| splashtop | splashtop | Semua versi sebelum 3.5.6.0 |
| splashtop | splashtop | Semua versi sebelum 3.5.8.0 |
| splashtop | splashtop for rmm | Semua versi sebelum 3.5.8.0 |
| splashtop | streamer | Semua versi sebelum 3.5.6.0 |