CVE-2024-42050 in Streamer
Summary
by MITRE • 07/28/2024
The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProvider_Inst.reg.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2025
The vulnerability identified as CVE-2024-42050 affects the Splashtop Streamer for Windows installer version 3.7.0.0 and earlier, presenting a significant privilege escalation risk that aligns with CWE-276, which addresses improper permissions for security-critical resources. During the installation process, the MSI installer creates temporary files in a directory with insufficient access controls, creating an exploitable condition that allows local attackers to gain SYSTEM-level privileges. This weakness stems from the installer's failure to properly secure temporary installation artifacts, specifically the CredProvider_Inst.reg file that is manipulated through an oplock mechanism.
The technical exploitation leverages a combination of weak temporary file permissions and the Windows credential provider installation process to achieve privilege escalation. When the installer runs, it places registry installation files in a temporary directory that lacks proper access controls, allowing a local user to establish an oplock on the CredProvider_Inst.reg file. This oplock mechanism, combined with the weak directory permissions, enables the attacker to modify or replace the registry file with malicious content that will be executed with SYSTEM privileges upon installation completion. The vulnerability operates at the intersection of improper file permissions and credential provider manipulation, creating a direct path to system-level compromise.
The operational impact of this vulnerability is substantial, as it allows any local user to escalate their privileges to SYSTEM level without requiring additional authentication or elevated access rights. This creates a persistent security risk that can be exploited by both malicious actors and compromised users within the system. The vulnerability affects the Windows installer environment and specifically targets the credential provider installation component, making it particularly dangerous in enterprise environments where Splashtop Streamer is deployed. The attack vector requires only local access and does not depend on network connectivity, making it difficult to detect and prevent through traditional network-based security measures.
Organizations should immediately update to Splashtop Streamer version 3.7.0.0 or later to remediate this vulnerability, as the patch addresses the weak temporary file permissions and proper credential provider handling. System administrators should also implement monitoring for unauthorized registry modifications and temporary file access patterns that could indicate exploitation attempts. The vulnerability demonstrates the importance of proper temporary file handling in installer components and aligns with ATT&CK technique T1068, which covers privilege escalation through local exploit techniques. Security teams should conduct vulnerability assessments to identify systems running affected versions and ensure that all installations follow secure configuration practices that prevent weak permissions in temporary directories. The remediation process should include verifying that temporary installation files are properly secured and that credential provider installations occur with appropriate access controls to prevent similar exploitation vectors in other software components.