CVE-2019-13142 Privilege escalation in n/a
Local attackers can overwrite files in a world-writable directory to execute code as SYSTEM, leading to privilege escalation in Razer Surround.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13142?
CVE-2019-13142 is a medium-severity vulnerability in n/a, published on 9 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver\. The DACL on this folder allows any user to overwrite contents of files in this folder, resulting in Elevation of Privilege.
Weakness: CWE-732
Which versions are affected by CVE-2019-13142?
It affects 1 product.
Products include Razer Surround.
How do I fix CVE-2019-13142?
No fix has been published for CVE-2019-13142 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13142 being exploited?
There is no known exploitation of CVE-2019-13142 in the wild and no public exploit code.
Sources
Also known as GHSA-98w8-8hm2-7f2j.