Dr. Oliver Schwarz

**Name of the Vulnerable Software and Affected Versions** Razer Synapse versions 3.7.1209.121307 and earlier **Description** The issue allows for privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into `%PROGRAMDATA%RazerSynapse3Servicebin` if they do so before the service is installed and if they deny write access for the `SYSTEM` user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. **Recommendations** For Razer Synapse versions 3.7.1209.121307 and earlier, consider disabling the service until a patch is available to prevent exploitation of the race condition. Restrict access to the `%PROGRAMDATA%RazerSynapse3Servicebin` directory to minimize the risk of malicious DLL placement. Avoid using the Razer driver installer until the issue is resolved to prevent potential privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Razer Synapse versions prior to 3.7.0830.081906 **Description** The issue arises due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can exploit this by placing malicious DLLs into `%PROGRAMDATA%RazerSynapse3Servicebin` before the service is installed, and then denying write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, using self-signed DLLs is sufficient for exploitation. The validity of the DLL signatures is not checked, allowing local Windows users to abuse the Razer driver installer to obtain administrative privileges on Windows. **Recommendations** For versions prior to 3.7.0830.081906, update to version 3.7.0830.081906 or later to resolve the issue. As a temporary workaround, consider restricting access to the `%PROGRAMDATA%RazerSynapse3Servicebin` directory to prevent malicious DLL placement. Additionally, ensure proper privilege management and certificate validation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Razer Synapse versions prior to 3.7.0228.022817 **Description** The issue allows privilege escalation because Razer Synapse relies on `%PROGRAMDATA%RazerSynapse3Servicebin` even if `%PROGRAMDATA%Razer` has been created by any unprivileged user before Synapse is installed. An unprivileged user may have placed Trojan horse DLLs there. **Recommendations** For versions prior to 3.7.0228.022817, update to version 3.7.0228.022817 or later to resolve the issue. As a temporary workaround, consider restricting access to the `%PROGRAMDATA%RazerSynapse3Servicebin` directory to prevent potential exploitation.