Razer Synapse 3 vulnerabilities

Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the Devices directory, allowing local users to gain privileges via a Trojan horse in the RazerConfigNative.dll or RazerConfigNativeLOC.dll files.

Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, allowing local users to gain privileges via a malicious dbghelp.dll file.

In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.

A Link Following Local Privilege Escalation vulnerability in Razer Synapse 3 Chroma Connect. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Razer Chroma SDK installer; by creating a symbolic link, an attacker can abuse the installer to delete arbitrary files.

A Link Following Local Privilege Escalation vulnerability in the RazerPhilipsHueUninstall module of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Philips HUE module installer; by creating a symbolic link, an attacker can abuse the installer to delete arbitrary files.

A Link Following Local Privilege Escalation vulnerability in the Macro Module of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Razer Synapse Service; by creating a symbolic link, an attacker can abuse the service to delete arbitrary files.