PT-2019-9872 · Corsair · Corsair Link

Publicado 2019-09-27 · Atualizado 2019-10-01 · CVE-2018-19592

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Corsair Link version 4.9.7.35

Description The issue is related to the "CLink4Service" service, which is installed with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITYSYSTEM, potentially leading to total system takeover.

Recommendations For Corsair Link version 4.9.7.35, consider updating the permissions of the "CLink4Service" service to prevent unprivileged users from taking control of it. As a temporary workaround, restrict access to the service to minimize the risk of exploitation.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2018-19592

Produtos afetados

Corsair Link

Referências · 4

• 🔥 https://github.com/BradyDonovan/CVE-2018-19592/blob/master/CLink4Service · Exploit
• http://forum.corsair.com/v3/showthread.php?t=155646 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19592 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19592 · Aviso do Fabricante