ZDI-25-921: Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Philips HUE module installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-9870.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-921?
The ZDI-25-921 vulnerability has been assigned a CVSS rating of 7, indicating a high severity level.
How do I fix ZDI-25-921?
To mitigate ZDI-25-921, users should update Razer Synapse 3 to the latest version provided by Razer.
Who is affected by ZDI-25-921?
ZDI-25-921 affects installations of Razer Synapse 3 on systems where the attacker can execute low-privileged code.
What type of attack can exploit ZDI-25-921?
ZDI-25-921 can be exploited by local attackers to escalate privileges on affected systems.
Can ZDI-25-921 be exploited remotely?
No, ZDI-25-921 requires that the attacker already has access to execute low-privileged code locally on the target system.