PT-2025-20563 · Avg · Avg Tuneup

Published 2025-05-09 · Updated 2025-07-29 · CVE-2024-13960

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVG TuneUp version 23.4 (build 15592)

Description The issue allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a time-of-check to time-of-use (TOCTTOU) attack. This is achieved through the TuneUp Service in AVG TuneUp on Windows 10.

Recommendations For AVG TuneUp version 23.4 (build 15592), consider disabling the TuneUp Service as a temporary workaround until a patch is available. Restrict access to the TuneUp Service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

CVE-2024-13960

ZDI-25-707

Affected Products

Avg Tuneup

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13960 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-707 · Security Note
• https://twitter.com/VulmonFeeds/status/1920943358194700300 · Twitter Post
• https://twitter.com/CVEnew/status/1920869016291402160 · Twitter Post
• https://t.me/cvenotify/121594 · Telegram Post
• https://t.me/cvetracker/23485 · Telegram Post
• https://twitter.com/cybercronai/status/1921377404221620489 · Twitter Post
• https://gendigital.com/us/en/contact-us/security-advisories · Note