CVE-2024-13962: Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810
First published: Fri May 09 2025(Updated: )
Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
Credit: security@nortonlifelock.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Avast CleanUp |
Remedy
Upgrade to Avast Cleanup Premium 24.3.17165.19178 or newer
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-13962?
CVE-2024-13962 has a high severity rating due to its potential for local privilege escalation and arbitrary code execution.
How do I fix CVE-2024-13962?
Fixing CVE-2024-13962 involves applying the latest patches provided by Gen Digital for Avast Cleanup Premium.
Who is affected by CVE-2024-13962?
CVE-2024-13962 affects users of Avast Cleanup Premium on Windows 10 Pro x64.
What types of attacks can exploit CVE-2024-13962?
Local attackers can exploit CVE-2024-13962 to escalate privileges and execute arbitrary code as the SYSTEM user.
Is it important to address CVE-2024-13962 immediately?
Yes, addressing CVE-2024-13962 is crucial due to the significant risk of unauthorized access and system compromise.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/gen digital
- canonical/avast cleanup