CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARY_PATH_NAME, leading to complete control of the affected system. The issue exists due to the Windows "Everyone" group being granted SERVICE_ALL_ACCESS permissions to the CorsairService Service.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-10-11

Last modified

2024-08-05

Weaknesses

CWE-276

Affected products

• Corsair Utility Engine (Corsair)

References

• https://github.com/TheRealJoeDoran/CVE/blob/master/CVE-2018-12441/CVE-2018-12441.txt