Dongle Local Privilege Escalation Vulnerability

Dongle Local Privilege Escalation Vulnerability

Local permission escalation

Also caused by upgrades

1. Place the exeaddresses of accounts in the directory of the dongle Upgrade Center and replace them with update.exe.
 

2. Open dongle and prompt for a new update. Then click "Update Now". An account is successfully added.
 

3. After the update is complete, a calculator will be provided. After checking the update, click it.
 

 

Proof of vulnerability:

Also caused by upgrades

1. Place the exeaddresses of accounts in the directory of the dongle Upgrade Center and replace them with update.exe.
 

2. Open dongle and prompt for a new update. Then click "Update Now". An account is successfully added.
 

3. After the update is complete, a calculator will be provided. After checking the update, click it.
 

 

Solution:

File pre-run Verification