CVE-2024-42053

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42053

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

he MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a version.dll file in the folder.

References
Link Resource
https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released Release Notes
https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*
History

03 Sep 2025, 19:44

Type Values Removed Values Added
CPE cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*
First Time Splashtop
Splashtop streamer
References () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md - () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md - Third Party Advisory
References () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released - () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released - Release Notes

21 Nov 2024, 09:33

Type Values Removed Values Added
References () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md - () https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md -
References () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released - () https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released -

01 Aug 2024, 13:59

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-28 03:15

Updated : 2025-09-03 19:44

NVD link : CVE-2024-42053

Mitre link : CVE-2024-42053

CVE.ORG link : CVE-2024-42053

JSON object : View

Products Affected

splashtop

CWE
CWE-276

Incorrect Default Permissions