CVE-2024-42051

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42051

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

he MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.

References
Link Resource
https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released Release Notes
https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*
History

03 Sep 2025, 19:46

Type Values Removed Values Added
References () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md - () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md - Third Party Advisory
References () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released - () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released - Release Notes
CPE cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*
First Time Splashtop
Splashtop streamer

21 Nov 2024, 09:33

Type Values Removed Values Added
References () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md - () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md -
References () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released - () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released -

01 Aug 2024, 13:59

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-28 03:15

Updated : 2025-09-03 19:46

NVD link : CVE-2024-42051

Mitre link : CVE-2024-42051

CVE.ORG link : CVE-2024-42051

JSON object : View

Products Affected

splashtop

CWE
CWE-1391

Use of Weak Credentials