CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 4CVE-2022-47631 – Razer Synapse Race Condition / DLL Hijacking
https://notcve.org/view.php?id=CVE-2022-47631
14 Sep 2023 — Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL... • https://packetstorm.news/files/id/174696 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 4CVE-2022-47632 – Razer Synapse Race Condition / DLL Hijacking
https://notcve.org/view.php?id=CVE-2022-47632
27 Jan 2023 — Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a ... • https://packetstorm.news/files/id/174696 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 6CVE-2021-44226 – Razer Synapse Race Condition / DLL Hijacking
https://notcve.org/view.php?id=CVE-2021-44226
23 Mar 2022 — Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there. Razer Synapse versiones anteriores a 3.7.0228.022817, permite una escalada de privilegios porque es basado en %PROGRAMDATA%\Razer\Synapse3\Service\bin incluso si %PROGRAMDATA%\Razer ha sido creado por cualquier usuario no p... • https://packetstorm.news/files/id/174696 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30494
https://notcve.org/view.php?id=CVE-2021-30494
14 Apr 2021 — Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operacione... • https://versprite.com/advisories/razer-synapse-3-1 • CWE-276: Incorrect Default Permissions •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30493
https://notcve.org/view.php?id=CVE-2021-30493
14 Apr 2021 — Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operaciones... • https://versprite.com/advisories/razer-synapse-3-cve-2021-30493 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14398
https://notcve.org/view.php?id=CVE-2017-14398
13 Sep 2017 — rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection. rzpnk en Razer Synapse 2.20.15.1104 permite a los usuarios locales leer y escribir ubicaciones de memoria arbitrarias y, como consecuencia, ganar privilegios mediante una metodología que involucre el manejo de \Device\PhysicalMemory, IOCTL 0x22A064 y ZwMapViewOfSect... • https://twitter.com/FuzzySec/status/907722788219256832 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11652 – Razer Synapse 2.20 DLL Hijacking
https://notcve.org/view.php?id=CVE-2017-11652
26 Jul 2017 — Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file. Razer Synapse 2.20.15.1104 y anteriores emplea permisos débiles para el directorio CrashReporter, lo que permite que usuarios locales obtengan privilegios mediante un archivo troyano dbghelp.dll. Razer Synapse versions 2.20.15.1104 and below suffer from multiple dll search order hijacking vulnerabilities. • https://packetstorm.news/files/id/143516 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11653 – Razer Synapse 2.20 DLL Hijacking
https://notcve.org/view.php?id=CVE-2017-11653
26 Jul 2017 — Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll file. Razer Synapse 2.20.15.1104 y anteriores emplea permisos débiles para el directorio Devices, lo que permite que usuarios locales obtengan privilegios mediante un archivo troyano (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll. Razer Synapse versions 2.20.15.1104 and below suffer from mul... • https://packetstorm.news/files/id/143516 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 77%CPEs: 1EXPL: 5CVE-2017-9769 – Razer Synapse 2.20.15.1104 - rzpnk.sys ZwOpenProcess
https://notcve.org/view.php?id=CVE-2017-9769
22 Jul 2017 — A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process. Se podría enviar una llamada IOCTL especialmente manipulada al controlador rzpnk.sys en Razer Synapse 2.20.15.1104 que se reenviaría a ZwOpenProcess, permitiendo que se abra un manipulador para un proceso arbitrario. A vulnerability exists in the latest version of Razer Synapse (v2.20.15.1104 as of the day of disclosure) whic... • https://packetstorm.news/files/id/143450 •