PT-2024-29711 · Splashtop · Splashtop Streamer

Published 2024-07-28 · Updated 2025-09-03 · CVE-2024-42051

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Splashtop Streamer for Windows versions prior to 3.6.2.0

Description The MSI installer for Splashtop Streamer for Windows uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.

Recommendations For versions prior to 3.6.2.0, update to version 3.6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary folder used during installation to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1391

Related Identifiers

CVE-2024-42051

Affected Products

Splashtop Streamer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-42051 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42051 · Vendor Advisory
• https://t.me/cvedetector/1765 · Telegram Post
• https://t.me/cvenotify/87654 · Telegram Post
• https://t.me/cveNotify/134237 · Telegram Post
• https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released · Note
• https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md · Note