CVE-2024-42052 in Streamer
Summary
by MITRE • 07/28/2024
The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/15/2025
The vulnerability identified as CVE-2024-42052 represents a critical privilege escalation flaw within the Splashtop Streamer for Windows installation process. This issue affects versions prior to 3.5.8.0 and stems from improper handling of temporary installation directories that lack adequate access controls. The weakness lies in the installer's utilization of a temporary folder that grants excessive permissions to local users, creating an exploitable condition that can be leveraged for system-level compromise.
The technical exploitation mechanism involves a well-known technique that abuses weak directory permissions to achieve privilege escalation. During the installation process, the MSI installer creates temporary files in a directory that does not properly restrict access permissions. A local attacker can place a malicious wevtutil.exe file in this vulnerable temporary folder, which then gets executed with elevated privileges when the installer runs. This approach follows the established pattern of DLL hijacking and file replacement attacks, where attackers manipulate the installation environment to execute arbitrary code with higher privileges than initially granted.
The operational impact of this vulnerability is severe as it allows any local user to escalate their privileges to SYSTEM level access. This represents a significant compromise of the system's security model since the installer process typically runs with elevated privileges but should not be vulnerable to local user manipulation. The attack vector is particularly concerning because it requires no special privileges beyond local access and can be executed through standard installation procedures. The vulnerability effectively bypasses normal access controls and could enable attackers to gain complete system control, install persistent backdoors, modify system files, or extract sensitive data.
This vulnerability aligns with CWE-276, which addresses improper file permissions, and demonstrates characteristics consistent with ATT&CK technique T1068, which covers exploit for privilege escalation. The weakness also relates to broader categories of software installation vulnerabilities that have been documented in various security frameworks and incident reports. Organizations should immediately apply the vendor-provided patch to version 3.5.8.0 or later, as this represents the most effective mitigation strategy. Additionally, system administrators should conduct thorough inventory checks to identify all affected installations and implement monitoring for suspicious file placement activities in temporary directories. Network segmentation and least privilege access controls should be reviewed to minimize potential lateral movement if exploitation occurs, while endpoint protection solutions should be configured to detect and block unauthorized file modifications in installation-related directories.