CVE-2023-3513 RazerCentralService Unsafe Deserialization Escalation of Privilege
A local attacker can gain SYSTEM privileges by triggering insecure .NET deserialization via a named pipe in Razer Central.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3513?
CVE-2023-3513 is a high-severity unsafe deserialization vulnerability in Razer Central, published on 14 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and triggering an insecure .NET deserialization.
Which versions are affected by CVE-2023-3513?
It affects 1 product.
Products include Razer Razer Central.
How do I fix CVE-2023-3513?
No fix has been published for CVE-2023-3513 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-3513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3513 exists.
Other vulnerabilities in Razer Central
Sources
Also known as GHSA-mcfx-4963-264m.