CVE-2018-12441 - CVE House
Back to Database
Status published High CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with...

Vulnerability Description

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARY_PATH_NAME, leading to complete control of the affected system. The issue exists due to the Windows "Everyone" group being granted SERVICE_ALL_ACCESS permissions to the CorsairService Service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-12441

Credits & Attribution

No credits recorded in the NVD database.

References

More from corsair

View All →
CVE-2022-35860
Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically...
Unknown 0
CVE-2020-8808
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60...
High 7.8
CVE-2018-19592
The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with...
High 7.8

Affected Vendor

Affected Software

corsair utility engine
Vulnerable Versions:
3.2.87, 3.3.103, 3.4.95, 3.6.109, 3.7.99

Timeline

Official Publish: October 11th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.