正文

acer care_center 认证机制不恰当

admin
admin V管理员 /0 评论 /16 阅读
0416
此篇文章发布距今已超过1164天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2022-24285

利用情况

暂无

补丁情况

N/A

披露时间

2022-03-11
漏洞描述
Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://community.acer.com/en/kb/articles/14761
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 acer care_center * From
(including)
4.00.3000 		Up to
(excluding)
4.00.3042
CVSS3评分 7.8
  • 攻击路径 本地
  • 攻击复杂度 低
  • 权限要求 低
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 高
  • 保密性 高
  • 完整性 高
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-ID 漏洞类型 CWE-287 认证机制不恰当