CVE-2017-11653
HighSummary
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the Devices directory, allowing local users to gain privileges via a Trojan horse in the RazerConfigNative.dll or RazerConfigNativeLOC.dll files.
Risk Assessment
The organization may be exposed to unauthorized access by local users, potentially leading to privilege escalation and damage.
Recommendation
It is recommended to update Razer Synapse to the latest version and review the permissions of the Devices directory to minimize risk.
Other vulnerabilities in Razer Synapse
See all- CVE-2017-11652High
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, allowing local users to gain privileges via a malicious dbghelp.dll file.
- CVE-2017-9769Critical
In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.
Original NVD description (English source)
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll file.