CVE-2024-42052

Name of the Vulnerable Software and Affected Versions Splashtop Streamer for Windows versions prior to 3.5.8.0

Description The issue concerns the MSI installer for Splashtop Streamer for Windows, which uses a temporary folder with weak permissions during installation. A local user can exploit this weakness to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder.

Recommendations For versions prior to 3.5.8.0, update to version 3.5.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary folder used during installation to minimize the risk of exploitation.