CVE-2024-7240
F-Secure Total Link Following Local Privilege Escalation Vulnerability
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
22 Nov 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
F-Secure Total Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of F-Secure Total. User interaction on the part of an administrator is required to exploit this vulnerability.
The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23005.
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
F-Secure · TotalWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →