What is CVE-2020-13149?

CVE-2020-13149 is a high-severity vulnerability in Msi Dragon Center, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2020-05-18.

How severe is CVE-2020-13149?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2020-13149 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Msi Dragon Center

CVE-2020-13149

Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite system files and gain escalated privileges. One attack method is to change the Recommended App binary within App.json. Another attack method is to use this part of %PROGRAMDATA% for mounting an RPC Control directory.

EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Msi Dragon_center
N/a — versions n/a

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-13149?: CVE-2020-13149 is a high-severity vulnerability in Msi Dragon Center, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2020-05-18.
How severe is CVE-2020-13149?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2020-13149 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.