Vulnerability · Published Jan 25, 2024 · Assigned by Google
CVE-2023-3181Insecure Permissions in Splashtop Software Updater
High 7.8
In plain English
A high-severity security flaw in Splashtop Software Updater from Splashtop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splashtop | Splashtop Software Updater | 0 – before 1.5.6.21 |
Weakness: CWE-379 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H