CVE-2024-9497
Published: 24 January 2025
Description
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Security Summary
CVE-2024-9497 is a DLL hijacking vulnerability stemming from an uncontrolled search path in the USBXpress 4 SDK installer from Silicon Labs. This issue, classified under CWE-427, affects systems where the impacted installer is executed and carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
A local attacker can exploit this vulnerability by placing a malicious DLL in a directory prioritized by the installer's search path ahead of secure locations. Exploitation requires user interaction to run the installer, enabling privilege escalation and arbitrary code execution with high impacts on confidentiality, integrity, and availability, along with a change in scope.
Silicon Labs has published details on this vulnerability in their community advisory at https://community.silabs.com/068Vm00000JUQwd.
Details
- CWE(s)