CVE-2024-42051 in Streamer
Summary
by MITRE • 07/28/2024
The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/15/2025
The vulnerability identified as CVE-2024-42051 affects the Splashtop Streamer for Windows installer version 3.6.2.0 and earlier, presenting a significant privilege escalation risk through insecure temporary file handling during installation processes. This weakness stems from the installer's use of a temporary folder that lacks proper access controls, creating an exploitable condition that allows local attackers to elevate their privileges to the SYSTEM level. The vulnerability specifically targets the installation procedure where the installer creates temporary files in a location with insufficient permission restrictions, making it possible for unauthorized users to manipulate critical registry files.
The technical flaw manifests when the Splashtop Streamer installer creates temporary files in a directory that does not enforce strict access controls, particularly around the InstRegExp.reg file which is crucial for the installation process. This temporary folder typically resides in a location such as the Windows TEMP directory or a similar system location where default permissions may not adequately restrict access. Attackers can exploit this by replacing the InstRegExp.reg file with a malicious version that contains registry modifications designed to grant elevated privileges or establish persistence mechanisms. The weakness directly aligns with CWE-732, which describes improper restriction of operations within a security domain, and CWE-276, which addresses incorrect permissions for critical resources.
The operational impact of this vulnerability is substantial as it allows any local user to escalate their privileges to the SYSTEM level without requiring administrative credentials or complex attack vectors. This privilege escalation capability enables attackers to bypass normal security controls and gain complete control over the affected system. Once escalated to SYSTEM level, the attacker can modify system files, install malicious software, access all user data, and potentially establish persistent backdoors. The vulnerability affects organizations that deploy Splashtop Streamer through standard installation processes, particularly those where local user accounts may have access to systems where the installer runs or where the installation process occurs.
Security professionals should immediately implement mitigations including updating to Splashtop Streamer version 3.6.2.0 or later, which addresses this vulnerability through proper temporary file handling and access control enforcement. System administrators should also verify that temporary installation directories have appropriate permissions and consider implementing additional security measures such as monitoring for unauthorized file modifications in installation directories. The vulnerability demonstrates a pattern consistent with ATT&CK technique T1068, which covers privilege escalation through local exploitation, and T1547.001, which addresses registry run keys and startup folder modifications. Organizations should also consider implementing application whitelisting policies and monitoring for suspicious registry modifications during installation processes to prevent exploitation of similar weaknesses in other software products.