PT-2025-54255 · Tosibox · Tosibox Key Service

Published 2025-12-30 · Updated 2025-12-31 · CVE-2024-58315

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tosibox Key Service version 3.3.0

Description The software contains an unquoted service path issue. This allows local, non-privileged users to potentially execute code with elevated system privileges. Exploitation involves manipulating the service startup process by placing malicious code in the system root path, which can then be executed during application startup or system reboot.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

LPE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2024-58315

Affected Products

Tosibox Key Service

References · 8

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2024-5812.php · Exploit
• 🔥 https://packetstormsecurity.com/files/177260 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58315 · Vendor Advisory
• https://tosi.net · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58315 · Security Note
• https://twitter.com/CVEnew/status/2006332239689519561 · Twitter Post
• https://t.me/CVEtracker/41011 · Telegram Post
• https://vulncheck.com/advisories/tosibox-key-service-local-privilege-escalation-via-unquoted-service-path · Note