CVE-2024-7240: (0Day) F-Secure Total Link Following Local Privilege Escalation Vulnerability
F-Secure Total Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of F-Secure Total. User interaction on the part of an administrator is required to exploit this vulnerability.
The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23005.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7240?
CVE-2024-7240 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2024-7240?
To mitigate CVE-2024-7240, users should update F-Secure Total to the latest version provided by F-Secure.
What versions of F-Secure Total are affected by CVE-2024-7240?
CVE-2024-7240 affects F-Secure Total version 19.2.
Is user interaction required to exploit CVE-2024-7240?
Yes, user interaction by an administrator is required to exploit CVE-2024-7240.
Who can exploit CVE-2024-7240?
Local attackers with access to the affected system can exploit CVE-2024-7240.