CVEvulnerability

CVE-2022-24138

7.8 HIGH Published 2022-07-06 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-07-06
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-552

Description

IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -> high integrity ADMIN).

Affected configurations

• iobit advanced systemcare 15

Related

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References