CVE-2023-3514: RazerCentralSerivce Unsafe Named Pipe Permission Escalation of Privilege Vulnerability
Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and calling "AddModule" or "UninstallModules" command to execute arbitrary executable file.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this RazerCentralService vulnerability?
The vulnerability ID for this RazerCentralService vulnerability is CVE-2023-3514.
What is the severity of CVE-2023-3514?
The severity of CVE-2023-3514 is high.
How can a malicious actor exploit CVE-2023-3514?
A malicious actor with local access can exploit CVE-2023-3514 by communicating with the named pipe as a low-privilege user and calling the "AddModule" or "UninstallModules" command to execute arbitrary code with SYSTEM privileges.
Which version of Razer RazerCentral is affected by CVE-2023-3514?
Razer RazerCentral version up to and including 7.11.0.558 on Windows is affected by CVE-2023-3514.
Is there a fix available for CVE-2023-3514?
It is recommended to update Razer RazerCentral to a version that is not affected by CVE-2023-3514 or apply any patches or security updates provided by the vendor.