CVE-2017-11652
HighSummary
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, allowing local users to gain privileges via a malicious dbghelp.dll file.
Risk Assessment
The organization may be exposed to attacks from local users who can exploit this vulnerability to gain unauthorized privileges.
Recommendation
It is recommended to update Razer Synapse to the latest version and review the permissions of the CrashReporter directory to minimize risk.
Other vulnerabilities in Razer Synapse
See all- CVE-2017-11653High
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the Devices directory, allowing local users to gain privileges via a Trojan horse in the RazerConfigNative.dll or RazerConfigNativeLOC.dll files.
- CVE-2017-9769Critical
In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.
- CVE-2025-9871High
A Link Following Local Privilege Escalation vulnerability in Razer Synapse 3 Chroma Connect. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Razer Chroma SDK installer; by creating a symbolic link, an attacker can abuse the installer to delete arbitrary files.
- CVE-2025-9870High
A Link Following Local Privilege Escalation vulnerability in the RazerPhilipsHueUninstall module of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Philips HUE module installer; by creating a symbolic link, an attacker can abuse the installer to delete arbitrary files.
- CVE-2025-9869High
A Link Following Local Privilege Escalation vulnerability in the Macro Module of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Razer Synapse Service; by creating a symbolic link, an attacker can abuse the service to delete arbitrary files.
Original NVD description (English source)
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS