CVE-2022-24140
First published: Wed Jul 06 2022(Updated: )
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IOBit Advanced System Care | =15 | |
| IOBit Advanced System Care | =15 | |
| IObit Driver Booster | =9 | |
| Iobit Itop Screen Recorder | =2.1 | |
| Iobit Itop Screenshot | ||
| Iobit Itop Vpn | =3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-24140.
Which software products are affected by this vulnerability?
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot are affected by this vulnerability.
What is the severity of CVE-2022-24140?
The severity of CVE-2022-24140 is medium.
How does CVE-2022-24140 exploit work?
The exploit in CVE-2022-24140 involves sending HTTP requests in the update procedure of the affected software products to download a config file, and then parsing the HTTP location of the update from the file.
Are there any references or resources related to CVE-2022-24140?
Yes, you can find more information about this vulnerability at the following references: [http://advanced.com](http://advanced.com), [http://iobit.com](http://iobit.com), [https://github.com/tomerpeled92/CVE/](https://github.com/tomerpeled92/CVE/).
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/iobit
- canonical/iobit advanced system care
- version/iobit advanced system care/15
- canonical/iobit driver booster
- version/iobit driver booster/9
- canonical/iobit itop screen recorder
- version/iobit itop screen recorder/2.1
- canonical/iobit itop screenshot
- canonical/iobit itop vpn
- version/iobit itop vpn/3.2