1. Home
  2. CVE Database
  3. CVE-2018-12441
HIGH · 7.8

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the Corsair...

Vulnerability Description

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARY_PATH_NAME, leading to complete control of the affected system. The issue exists due to the Windows "Everyone" group being granted SERVICE_ALL_ACCESS permissions to the CorsairService Service.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CorsairCorsair Utility Engine3.2.87

Related Weaknesses (CWE)

CWE-276

References

FAQ

What is CVE-2018-12441?

CVE-2018-12441 is a vulnerability with a CVSS score of 7.8 (HIGH). The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the Corsair...

How severe is CVE-2018-12441?

CVE-2018-12441 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-12441?

Check the references section above for vendor advisories and patch information. Affected products include: Corsair Corsair Utility Engine.