CVE-2022-24139
First published: Wed Jul 06 2022(Updated: )
In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IOBit Advanced System Care | =15 | |
| IOBit Advanced System Care | =15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-24139?
CVE-2022-24139 is a vulnerability in IOBit Advanced System Care (AscService.exe) 15 that allows an attacker with SEImpersonatePrivilege to create a named pipe with the same name as one of ASCService's named pipes.
What is the severity of CVE-2022-24139?
The severity of CVE-2022-24139 is high, with a severity value of 7.8.
How does CVE-2022-24139 affect IOBit Advanced System Care?
CVE-2022-24139 affects IOBit Advanced System Care version 15 by allowing an attacker to create a named pipe with the same name as one of ASCService's named pipes, potentially leading to unauthorized access and privilege escalation.
How can I fix CVE-2022-24139?
To fix CVE-2022-24139, it is recommended to update to the latest version of IOBit Advanced System Care and apply any security patches provided by IOBit.
Where can I find more information about CVE-2022-24139?
You can find more information about CVE-2022-24139 on the official websites of IOBit Advanced System Care (http://iobit.com) and Advanced (http://advanced.com). Additionally, you can refer to the GitHub repository at https://github.com/tomerpeled92/CVE/ for technical details.
- collector/nvd-index
- agent/weakness
- agent/event
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/iobit
- canonical/iobit advanced system care
- version/iobit advanced system care/15