CVE-2024-13959

Name of the Vulnerable Software and Affected Versions AVG TuneUp version 24.2.16593.9844

Description The issue allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging the service to delete a directory. This is achieved by exploiting the TuneupSvc.exe in AVG TuneUp on Windows.

Recommendations For AVG TuneUp version 24.2.16593.9844, consider disabling the TuneupSvc.exe service as a temporary workaround until a patch is available. Restrict access to the vulnerable service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.