G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability

December 11th, 2024
ZDI-24-1486 ZDI-CAN-22629

CVE ID

CVE-2024-6871

CVSS Score

7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

G DATA

Affected Products

Total Security

Vulnerability Details

This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of autostart tasks. The issue results from incorrect permissions set on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

Additional Details

Fixed in version 25.5.18.333


Disclosure Timeline

  • 2024-02-13 - Vulnerability reported to vendor
  • 2024-12-11 - Coordinated public release of advisory
  • 2024-12-11 - Advisory Updated

Credit

Kolja Grassmann (cirosec GmbH)

Back to Advisories