Vulnerability in Heimdalsecurity Heimdal Premium Security
CVE-2022-24618
Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (14.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- af854a3a-2127-422b-91ae-364da2661108 (Not Applicable)
- support.heimdalsecurity.com/hc/en-us/articles/4425942979473-2-5-398-PROD-and-2-… (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-24618?
- CVE-2022-24618 is a high-severity vulnerability in Heimdalsecurity Heimdal Premium Security, classified under Improper Preservation of Permissions. CVSS score: 7.8/10. Published 2022-03-10.
- How severe is CVE-2022-24618?
- High severity. CVSS v3 base score is 7.8 out of 10.