CVE-2022-24140: Medium severity IObit Advanced System Care vulnerability
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-24140.
Which software products are affected by this vulnerability?
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot are affected by this vulnerability.
What is the severity of CVE-2022-24140?
The severity of CVE-2022-24140 is medium.
How does CVE-2022-24140 exploit work?
The exploit in CVE-2022-24140 involves sending HTTP requests in the update procedure of the affected software products to download a config file, and then parsing the HTTP location of the update from the file.
Are there any references or resources related to CVE-2022-24140?
Yes, you can find more information about this vulnerability at the following references: [http://advanced.com](http://advanced.com), [http://iobit.com](http://iobit.com), [https://github.com/tomerpeled92/CVE/](https://github.com/tomerpeled92/CVE/).