// For flags

CVE-2023-3181

Insecure Permissions in Splashtop Software Updater

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.

El proceso C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe crea una carpeta en C:\Windows\Temp~nsu.tmp y se copia en ella como Au_.exe. El archivo C:\Windows\Temp~nsu.tmp\Au_.exe se inicia automáticamente como SISTEMA cuando el sistema se reinicia o cuando un usuario estándar ejecuta una reparación de MSI utilizando el instalador de Windows de Splashtop Streamer. Dado que la carpeta C:\Windows\Temp~nsu.tmp hereda permisos de C:\Windows\Temp y Au_.exe es susceptible al secuestro de DLL, los usuarios estándar pueden escribirle una DLL maliciosa y elevar sus privilegios.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-06-09 CVE Reserved
  • 2024-01-25 CVE Published
  • 2025-06-03 CVE Updated
  • 2025-06-24 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-379: Creation of Temporary File in Directory with Insecure Permissions
CAPEC
  • CAPEC-165: File Manipulation
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Splashtop
Search vendor "Splashtop"
 Software Updater
Search vendor "Splashtop" for product "Software Updater"
 <= 1.5.6.21
Search vendor "Splashtop" for product "Software Updater" and version " <= 1.5.6.21"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe