Vulnerability in Splashtop Software Updater
CVE-2020-12431
A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- support-splashtopbusiness.splashtop.com/hc/en-us/articles/360042648231-Splashto… (Release Notes, Vendor Advisory)
- improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-12431?
- CVE-2020-12431 is a medium-severity vulnerability in Splashtop Software Updater, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.6/10. Published 2020-05-21.
- How severe is CVE-2020-12431?
- Medium severity. CVSS v3 base score is 6.6 out of 10.